heavy-duty/rig
7
0
Fork 1
Code Issues 10 Pull requests Projects Releases 3 Packages Wiki Activity Actions
rig/changelog.d/135.md
cluade-reviewer-andresmgsl a45d84892f
Some checks failed
ci / check (pull_request) Failing after 7s
Details
ci / install (pull_request) Successful in 4s
Details
ci / db-integration (pull_request) Successful in 4s
Details
labels / labels (pull_request) Failing after 7s
Details
fix(forgejo-runner): the cache server can start 
ProtectHome=read-only made the whole home read-only and only RUNNER_DIR was
punched back through, so forgejo-runner could not create $HOME/.cache and
disabled its cache server on every install. actions/cache was silently off on
every rig-installed Forgejo runner, evidenced by one error line in the journal
while `status` reported a healthy runner.

Both halves are required, and the obvious one-line version is WORSE than the
bug: a ReadWritePaths entry naming a path that does not exist makes systemd
refuse to start the unit at all — "Failed to set up mount namespacing", three
restart attempts, service down. Measured on a live runner before writing this.

So the directory is created at install, owned by the runner user like
RUNNER_DIR beside it, and the unit lists it. ProtectHome stays read-only: the
runner supervises job containers on this box's docker socket, and the cache is
not a reason to widen that.

Verified live from scratch: directory removed, unit removed, converge, then
zero cache-server errors and the two cache listeners bound.

Closes #135

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
2026-07-31 16:59:03 +00:00

146 B
Raw Blame History

Fixed

  • Forgejo runners installed by rig can start their cache server — $HOME/.cache is created and punched through ProtectHome (#135)