feat: support proxy in gitea-runner
This commit is contained in:
Sun-ZhenXing
@@ -30,3 +30,16 @@ GITEA_RUNNER_CPU_RESERVATION=0.1
|
||||
|
||||
# Reserved memory allocation.
|
||||
GITEA_RUNNER_MEMORY_RESERVATION=1G
|
||||
|
||||
# HTTP proxy used by the runner itself and by every job container.
|
||||
# The proxy must be reachable from containers: bind it to 0.0.0.0 on the host
|
||||
# and use host.docker.internal, for example http://host.docker.internal:7890
|
||||
GITEA_RUNNER_HTTP_PROXY=
|
||||
|
||||
# HTTPS proxy. Usually the same http:// endpoint as GITEA_RUNNER_HTTP_PROXY.
|
||||
GITEA_RUNNER_HTTPS_PROXY=
|
||||
|
||||
# Hosts that bypass the proxy. Keep host.docker.internal so Gitea and the
|
||||
# runner cache server stay direct. Do not use CIDR notation: curl inside job
|
||||
# containers does not support it.
|
||||
GITEA_RUNNER_NO_PROXY=localhost,127.0.0.1,::1,host.docker.internal
|
||||
|
||||
@@ -33,6 +33,9 @@ The default `http://host.docker.internal:3000` targets a Gitea server published
|
||||
| `GITEA_RUNNER_REGISTRATION_TOKEN` | empty | Required registration token. |
|
||||
| `GITEA_RUNNER_NAME` | `Gitea-Runner` | Runner name shown in Gitea. |
|
||||
| `GITEA_RUNNER_LABELS` | `ubuntu-latest`, `ubuntu-24.04`, `ubuntu-22.04` Docker labels | Comma-separated labels using job images from `docker.io/gitea/runner-images`. |
|
||||
| `GITEA_RUNNER_HTTP_PROXY` | empty | HTTP proxy for the runner and every job container. Empty disables proxying. |
|
||||
| `GITEA_RUNNER_HTTPS_PROXY` | empty | HTTPS proxy. Usually the same endpoint as the HTTP proxy. |
|
||||
| `GITEA_RUNNER_NO_PROXY` | `localhost,127.0.0.1,::1,host.docker.internal` | Hosts that bypass the proxy. |
|
||||
| `GITEA_RUNNER_CPU_LIMIT` / `GITEA_RUNNER_CPU_RESERVATION` | `1.0` / `0.1` | CPU limit and reservation. |
|
||||
| `GITEA_RUNNER_MEMORY_LIMIT` / `GITEA_RUNNER_MEMORY_RESERVATION` | `2G` / `1G` | Memory limit and reservation. |
|
||||
|
||||
@@ -42,6 +45,35 @@ The repository includes a ready-to-use `config.yaml`. To inspect a fresh upstrea
|
||||
docker run --entrypoint="" --rm gitea/runner:2.1.0 gitea-runner generate-config > config.yaml
|
||||
```
|
||||
|
||||
## Proxy
|
||||
|
||||
Set `GITEA_RUNNER_HTTP_PROXY` and `GITEA_RUNNER_HTTPS_PROXY` in `.env` and the whole stack uses the proxy. Both are empty by default, which disables proxying.
|
||||
|
||||
The proxy must listen on `0.0.0.0` on the host, not only `127.0.0.1`, otherwise containers cannot reach it through `host.docker.internal`. If the proxy is another container on the same network, use its service name instead.
|
||||
|
||||
Coverage:
|
||||
|
||||
- The runner's own requests to Gitea and action repositories.
|
||||
- Every job container, because the runner injects the proxy variables in both upper and lower case.
|
||||
|
||||
### Proxying builds
|
||||
|
||||
The Docker CLI does not take proxy settings from environment variables, but it does read them from its own config file. Writing that file once as the first step of a job makes every later `docker build`, `docker compose build`, and `docker buildx build` in that job use the proxy without any per-command flags.
|
||||
|
||||
```yaml
|
||||
- run: mkdir -p ~/.docker && printf '{"proxies":{"default":{"httpProxy":"%s","httpsProxy":"%s","noProxy":"%s"}}}' "$HTTP_PROXY" "$HTTPS_PROXY" "$NO_PROXY" > ~/.docker/config.json
|
||||
```
|
||||
|
||||
The job container already has those three variables, because the runner injects them, so the step needs no configuration of its own. When proxying is disabled the values are empty and builds behave as before.
|
||||
|
||||
Dockerfiles need no `ARG` lines for this, because the proxy variables are predefined build arguments.
|
||||
|
||||
Run this step before any `docker login` in the same job. `docker login` merges into the same file and keeps the proxy section, but writing the file after a login would discard the stored credentials.
|
||||
|
||||
Not covered: image pulls. Job container images and the base images pulled during a `docker build` are fetched by the host Docker daemon, which only honors its own proxy configuration. Configure it separately: Docker Desktop under **Settings -> Resources -> Proxies** (Docker Desktop ignores the `proxies` key in `daemon.json`), or on Linux a systemd drop-in at `/etc/systemd/system/docker.service.d/http-proxy.conf` with `Environment="HTTP_PROXY=..."`, or the `proxies` key in `daemon.json` on Docker Engine 23.0 and later.
|
||||
|
||||
Do not put CIDR ranges in `GITEA_RUNNER_NO_PROXY`. The runner accepts them but `curl` inside job containers does not.
|
||||
|
||||
## Storage and Health
|
||||
|
||||
- `gitea_runner_data` stores registration and runner state.
|
||||
|
||||
@@ -33,6 +33,9 @@ docker compose up -d
|
||||
| `GITEA_RUNNER_REGISTRATION_TOKEN` | 空 | 必填的注册令牌。 |
|
||||
| `GITEA_RUNNER_NAME` | `Gitea-Runner` | Gitea 中显示的 Runner 名称。 |
|
||||
| `GITEA_RUNNER_LABELS` | `ubuntu-latest`、`ubuntu-24.04`、`ubuntu-22.04` Docker labels | 以逗号分隔的 labels，默认 job image repository 为 `docker.io/gitea/runner-images`。 |
|
||||
| `GITEA_RUNNER_HTTP_PROXY` | 空 | Runner 和每个任务容器使用的 HTTP 代理。留空则禁用代理。 |
|
||||
| `GITEA_RUNNER_HTTPS_PROXY` | 空 | HTTPS 代理。通常与 HTTP 代理使用同一地址。 |
|
||||
| `GITEA_RUNNER_NO_PROXY` | `localhost,127.0.0.1,::1,host.docker.internal` | 不经过代理的主机列表。 |
|
||||
| `GITEA_RUNNER_CPU_LIMIT` / `GITEA_RUNNER_CPU_RESERVATION` | `1.0` / `0.1` | CPU 限制和预留。 |
|
||||
| `GITEA_RUNNER_MEMORY_LIMIT` / `GITEA_RUNNER_MEMORY_RESERVATION` | `2G` / `1G` | 内存限制和预留。 |
|
||||
|
||||
@@ -42,6 +45,35 @@ docker compose up -d
|
||||
docker run --entrypoint="" --rm gitea/runner:2.1.0 gitea-runner generate-config > config.yaml
|
||||
```
|
||||
|
||||
## 代理
|
||||
|
||||
在 `.env` 中设置 `GITEA_RUNNER_HTTP_PROXY` 和 `GITEA_RUNNER_HTTPS_PROXY`，整个栈即使用代理。两者默认为空，即不启用代理。
|
||||
|
||||
代理必须在宿主机上监听 `0.0.0.0` 而非仅 `127.0.0.1`，否则容器无法通过 `host.docker.internal` 访问。如果代理是同一网络上的另一个容器，请使用其服务名代替。
|
||||
|
||||
覆盖范围：
|
||||
|
||||
- Runner 自身对 Gitea 和 action 仓库的请求。
|
||||
- 每个任务容器，因为 Runner 会同时注入大写和小写形式的代理变量。
|
||||
|
||||
### 为构建配置代理
|
||||
|
||||
Docker CLI 不从环境变量读取代理设置，但会从其自身的配置文件中读取。在任务的第一步写入该文件后，该任务中后续的 `docker build`、`docker compose build` 和 `docker buildx build` 都会自动使用代理，无需任何命令行参数。
|
||||
|
||||
```yaml
|
||||
- run: mkdir -p ~/.docker && printf '{"proxies":{"default":{"httpProxy":"%s","httpsProxy":"%s","noProxy":"%s"}}}' "$HTTP_PROXY" "$HTTPS_PROXY" "$NO_PROXY" > ~/.docker/config.json
|
||||
```
|
||||
|
||||
任务容器已经拥有这三个变量，因为 Runner 会注入它们，因此该步骤无需额外配置。当代理被禁用时，这些值为空，构建行为与之前相同。
|
||||
|
||||
Dockerfiles 无需为此添加 `ARG` 行，因为这些代理变量是预定义的构建参数。
|
||||
|
||||
请在同任务的任何 `docker login` 之前运行此步骤。`docker login` 会合并到同一文件并保留代理部分，但在登录之后写入该文件会丢弃已存储的凭据。
|
||||
|
||||
不覆盖：镜像拉取。任务容器镜像以及 `docker build` 期间拉取的基础镜像由宿主机 Docker 守护进程获取，该守护进程仅使用自身的代理配置。请单独配置：Docker Desktop 在 **Settings -> Resources -> Proxies** 中设置（Docker Desktop 会忽略 `daemon.json` 中的 `proxies` 键），在 Linux 上可在 `/etc/systemd/system/docker.service.d/http-proxy.conf` 中配置 systemd drop-in 并设置 `Environment="HTTP_PROXY=..."`，或在 Docker Engine 23.0 及以上版本的 `daemon.json` 中使用 `proxies` 键。
|
||||
|
||||
请勿在 `GITEA_RUNNER_NO_PROXY` 中使用 CIDR 格式。Runner 可以接受，但任务容器中的 `curl` 不支持。
|
||||
|
||||
## 存储与健康检查
|
||||
|
||||
- `gitea_runner_data` 保存注册信息和 Runner 状态。
|
||||
|
||||
@@ -17,6 +17,9 @@ services:
|
||||
GITEA_RUNNER_REGISTRATION_TOKEN: ${GITEA_RUNNER_REGISTRATION_TOKEN}
|
||||
GITEA_RUNNER_NAME: ${GITEA_RUNNER_NAME:-Gitea-Runner}
|
||||
GITEA_RUNNER_LABELS: ${GITEA_RUNNER_LABELS:-ubuntu-latest:docker://docker.io/gitea/runner-images:ubuntu-latest,ubuntu-24.04:docker://docker.io/gitea/runner-images:ubuntu-24.04,ubuntu-22.04:docker://docker.io/gitea/runner-images:ubuntu-22.04}
|
||||
HTTP_PROXY: ${GITEA_RUNNER_HTTP_PROXY:-}
|
||||
HTTPS_PROXY: ${GITEA_RUNNER_HTTPS_PROXY:-}
|
||||
NO_PROXY: ${GITEA_RUNNER_NO_PROXY:-localhost,127.0.0.1,::1,host.docker.internal}
|
||||
extra_hosts:
|
||||
- host.docker.internal:host-gateway
|
||||
volumes:
|
||||
|
||||
Reference in New Issue
Block a user