Dockerfile.linux

# GitHub Actions self-hosted runner — Linux template
# Multi-distro: ubuntu-2404, ubuntu-2204, debian-trixie, debian-bookworm
# Generated Dockerfiles are produced by generate-dockerfile.sh (do NOT edit generated output)
#
# NOTE: This is a template — markers are expanded by generate-dockerfile.sh.
# Package lists and distro settings are in config.yaml — do not hardcode them here.
#
# Build: generate-dockerfile.sh <distro> <build_flavor> > Dockerfile.<distro>-<build_flavor>
#        docker buildx build --build-arg VERSION=2.332.0 -f Dockerfile.<distro>-<build_flavor> .
ARG REMOTE_CR=ghcr.io/oorabona
@@BASE_IMAGE@@

# Ensure root for package installation (some base images set a non-root USER)
USER root

ARG VERSION
ARG TARGETARCH

@@LABELS@@

# Install base packages with BuildKit cache mounts for faster rebuilds
@@INSTALL_PACKAGES@@

# Install dev-flavor extra packages (empty for base flavor)
@@DEV_PACKAGES@@

# Install tini as PID 1 init (zombie reaping + signal forwarding to runner agent)
# Install sudo — many workflows expect `sudo apt-get install` to work
RUN apt-get update && apt-get install -y --no-install-recommends tini sudo \
    && rm -rf /var/lib/apt/lists/*

@@CREATE_USER@@

# Allow runner to use sudo without password (matches GitHub-hosted runner behavior)
RUN echo "runner ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/runner \
    && chmod 0440 /etc/sudoers.d/runner

# Add runner to docker group for DooD (Docker-outside-of-Docker)
# Mount the host Docker socket: -v /var/run/docker.sock:/var/run/docker.sock
RUN groupadd -f docker && usermod -aG docker runner

WORKDIR /home/runner/actions-runner

# Runner agent — pre-downloaded by prepare-build-context.sh into the build context
# (avoids network issues inside BuildKit containers hitting GitHub CDN)
COPY runner.tar.gz runner.tar.gz
RUN tar xzf runner.tar.gz && \
    rm runner.tar.gz && \
    ./bin/installdependencies.sh

COPY entrypoint.sh /home/runner/entrypoint.sh
RUN chmod +x /home/runner/entrypoint.sh

# Disable runner auto-update to prevent crash loops in containerised deployments
ENV RUNNER_DISABLE_AUTO_UPDATE=1
ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache
ENV HOME=/home/runner

# Entrypoint runs as root to fix volume permissions, then drops to runner via gosu
RUN apt-get update && apt-get install -y --no-install-recommends gosu \
    && rm -rf /var/lib/apt/lists/* \
    && gosu nobody true

# Do NOT set USER here — entrypoint starts as root, fixes volume perms, then exec gosu runner
ENTRYPOINT ["tini", "--", "/home/runner/entrypoint.sh"]