From 5dad3f99dd72ae04d50440302cc6051d6711b91b Mon Sep 17 00:00:00 2001 From: waffle2k Date: Mon, 6 Jul 2026 13:50:37 -0700 Subject: [PATCH] =?UTF-8?q?Drop=20the=20dead=20dockerd/vfs=20step=20?= =?UTF-8?q?=E2=80=94=20the=20job=20container=20already=20shares=20the=20ho?= =?UTF-8?q?st's=20Docker=20socket?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Verified from the actual job container logs: act_runner bind-mounts /var/run/docker.sock into every job container unconditionally, even before privileged mode was enabled. The previous step's nested dockerd never actually got used. --- .gitea/workflows/docker-build-push.yml | 19 ++++--------------- 1 file changed, 4 insertions(+), 15 deletions(-) diff --git a/.gitea/workflows/docker-build-push.yml b/.gitea/workflows/docker-build-push.yml index ef31504..878dab4 100644 --- a/.gitea/workflows/docker-build-push.yml +++ b/.gitea/workflows/docker-build-push.yml @@ -11,21 +11,10 @@ jobs: steps: - uses: actions/checkout@v4 - # act_runner's job container ships docker+dockerd but doesn't start the - # daemon itself. This host's outer Docker uses overlay2, and overlay2 - # can't nest inside overlay2 (BuildKit mount fails with "invalid - # argument"), so the inner daemon has to use vfs instead — slower, no - # layer dedup, but the only storage driver that actually works nested - # here. - - name: Start Docker daemon (vfs storage driver) - run: | - dockerd --storage-driver=vfs > /tmp/dockerd.log 2>&1 & - for i in $(seq 1 30); do - docker info >/dev/null 2>&1 && break - sleep 1 - done - docker info >/dev/null 2>&1 || { cat /tmp/dockerd.log; exit 1; } - + # act_runner bind-mounts the admin host's real Docker socket into every + # job container (Docker-outside-of-Docker, not a nested daemon), so + # `docker` here talks straight to the host's daemon — no separate + # dockerd to start. - name: Build and push image env: REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}