The Actions runner

It’s `gitea/runner` now

The plan said gitea/act_runner:0.6.1. That project stopped in April 2026; the runner is now gitea/runner, version 5.x. The image tags follow the same suffixes: 5.3.0-dind, 5.3.0-dind-rootless, 5.3.0.

How jobs get Docker — pick your risk

Flavour	Jobs use	The catch
`-dind` (docs’ recommendation)	The runner’s own Docker daemon	`privileged: true` — a job could break out to the host
`-dind-rootless`	Its own daemon, as uid 1000	Still privileged, plus AppArmor profile and slirp4netns setup
plain + host socket	The host’s daemon	“Equivalent to root”; trusted repositories only

This setup uses -dind: jobs never touch the host’s Docker socket, and with registration disabled the only workflows that run are your own.

Register without seeing the token

cd /opt/vps-infra/starter/secrets
(umask 077; docker exec -u git gitea gitea actions generate-runner-token | tr -d '\n' > gitea_runner_token.txt)

The runner reads it from a file:

gitea-runner:
  image: gitea/runner:5.3.0-dind
  privileged: true
  environment:
    - GITEA_INSTANCE_URL=https://git.fromjon.com
    - GITEA_RUNNER_REGISTRATION_TOKEN_FILE=/run/secrets/gitea_runner_token
    - GITEA_RUNNER_NAME=vps
  volumes:
    - gitea-runner-data:/data            # the .runner registration file
    - gitea-runner-docker:/var/lib/docker # job images and build layers
  networks: [gitea_runner]               # outbound only

The log should end with Runner registered successfully and the labels ubuntu-latest, ubuntu-24.04, ubuntu-22.04.

Smoke test

A repository with .gitea/workflows/test.yml:

name: runner-test
on: [push, workflow_dispatch]
jobs:
  hello:
    runs-on: ubuntu-latest
    steps:
      - run: echo "hello from the runner" && uname -a
      - uses: actions/checkout@v4
      - run: ls -la

The first job pulls docker.gitea.com/runner-images:ubuntu-latest (about 2.3 GB) once; it stays in the runner’s Docker volume. uses: actions come from github.com by default (DEFAULT_ACTIONS_URL).

A note on “Server listening on port 22”

That line appears in the Gitea container’s log, not the runner’s: the Gitea image starts its own SSH server inside the container. It isn’t published or routed, and DISABLE_SSH removes SSH from clone URLs.