Setup up Gitea Runner with Podman in LXC

For some time now I already host a gitea instace and now with this blog I finally have some real usage for CI, but setting up gitea actions in an LXC and using Podman instead of Docker Engine was not as straight forward as expected.

Setup PVE

Setup Proxmox, so podman can run in unpreviliged container. Podman uses high user ids for it’s containers, so we need to extend the range that is usable by LXCs.

It is also required to change the limit explictly in the containers config, and we need to add a kernel module. Those ranges are defined in /etc/subuid for user ids and /etc/subgid for group ids, in the from of <usr>:<start_uid>:<count>. You could change them manually or change them with

(the first number defines the start and the secound the end of ids)

usermod --add-subuids 100000-300000 --add-subgids 100000-300000 root

So /etc/subuid should contains root:100000:200000.

We also need to edit the LXC config /etc/pve/lxc/<VMID>.conf.

# <container_uid> <host_uid> <count>
lxc.idmap: u 0 100000 165536 # uids 0..165536 (container) -> 100000..265536 (host)
lxc.idmap: g 0 100000 165536 # gids
lxc.cgroup2.devices.allow: c 10:200 rwm  # cgroup2 for PVE >= 7.0
lxc.mount.entry: /dev/net dev/net none bind,create=dir

I got the information from here together with infos from the official docu.

Setup LXC

As we want to run podman as an unpreviliged user, lets create on:

useradd -U <USER_NAME>

apt install podman
systemctl --user -M act@ enable podman.socket

First, since we wanna run this rootless, we need a new unpreviliged user.

The binary is here available. I placed it there /usr/local/bin/act_runner and made it executable by the new created user.

cd /usr/local/bin
curl https://dl.gitea.com/act_runner/0.2.13/act_runner-0.2.13-linux-amd64 > act_runner
chmod +x act_runner
chown act:act act_runner

A config that references the regrister file and the podman socket is needed, I placed it in /etc/act_runner/config.yaml

mkdir /etc/act_runner
chown -R act:act /etc/act_runner

# config.yaml
runner:
  file: /etc/act_runner/.runner
  envs:
    XDG_RUNTIME_DIR directory: "/run/user/1000"

container:
  docker_host: "unix:///run/user/<USER_ID>/podman/docker.sock"

cache:
  # Enable cache server to use actions/cache.
  enabled: true
  # The directory to store the cache data.
  # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
  dir: "/etc/act_runner/cache"

And last but not least, we need to regristrate the runner, wich will create the runner file: The token is accsasible through Settings -> Actions -> Runners -> Create new Runner.

(I’d recommend running the regristration as the unpreviliged user.)

/usr/local/bin/act_runner register -c /etc/act_runner/config.yaml 
    --instance <GITEA ADRESS> --token <TOKEN>
    --no-interactive

Create Act Runner User Service

Create a user service in in the following file: /usr/lib/systemd/user/act_runner.servic

Description=Gitea Actions runner
Documentation=https://gitea.com/gitea/act_runner
After=podman.socket

[Service]
ExecStart=/usr/local/bin/act_runner daemon -c /etc/act_runner/config.yaml
Delegate=true
Type=simple

[Install]
WantedBy=default.target

Auto start user Services

To start the user services, you can add a drop-in and add the Install, by running:

systemctl edit user@1001 --drop-in=start_act_runner

and inserting

[Unit]
After=gitea.service

[Install]
WantedBy=multi-user.target

In the end, all left to do is, enable the user:

systemctl status user@1001