44 lines
1.6 KiB
Desktop File
44 lines
1.6 KiB
Desktop File
[Unit]
|
|
Description=EasyAI AI Gateway rootless DinD Gitea Actions runner v2
|
|
Requires=docker.service
|
|
After=network-online.target docker.service
|
|
Wants=network-online.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
User=root
|
|
Group=root
|
|
Environment=RUNNER_SECURITY_OPTIONS=
|
|
EnvironmentFile=-/etc/easyai-gateway-ci-v2/runner.env
|
|
ExecStartPre=-/usr/bin/docker rm --force easyai-gateway-ci-v2-runner
|
|
ExecStart=/usr/bin/docker run --rm --pull=never --name easyai-gateway-ci-v2-runner --privileged --pids-limit 4096 $RUNNER_SECURITY_OPTIONS --volume easyai-gateway-ci-v2-data:/data --volume /etc/easyai-gateway-ci-v2/config.yaml:/config.yaml:ro --volume /opt/easyai-gateway-ci:/opt/easyai-gateway-ci:ro --env CONFIG_FILE=/config.yaml --env DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns --env DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520 --env DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--pidns docker.io/gitea/runner:2.0.0-dind-rootless@sha256:5b7b625ff773d0ee761788c47582503ec1b241fa5b81edebad48a57e663f4f3a
|
|
ExecStop=-/usr/bin/docker stop --time 360 easyai-gateway-ci-v2-runner
|
|
Restart=always
|
|
RestartSec=5s
|
|
TimeoutStartSec=60s
|
|
TimeoutStopSec=390s
|
|
|
|
# systemd only launches the host Docker client. Pull-request jobs run inside the
|
|
# nested rootless daemon and never receive the host or nested Docker socket.
|
|
NoNewPrivileges=true
|
|
CapabilityBoundingSet=
|
|
AmbientCapabilities=
|
|
PrivateTmp=true
|
|
PrivateDevices=true
|
|
ProtectSystem=strict
|
|
ProtectHome=true
|
|
ProtectKernelTunables=true
|
|
ProtectKernelModules=true
|
|
ProtectKernelLogs=true
|
|
ProtectControlGroups=true
|
|
ProtectClock=true
|
|
ProtectHostname=true
|
|
LockPersonality=true
|
|
RestrictRealtime=true
|
|
RestrictSUIDSGID=true
|
|
SystemCallArchitectures=native
|
|
UMask=0077
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|