Forgejo runner with DinD under rootless Podman

.config__containers__systemd__docker_in_docker.container

[Unit]
Description=Docker-in-Docker for Forgejo Runner
Wants=network-online.target
After=network-online.target

[Container]
Image=docker.io/library/docker:29.5.2-dind
ContainerName=docker_in_docker
Network=runner_internal.network
AddHost=forgejo.example.com:10.11.12.13 # Manual mapping of domain if runners are on same machine as Forgejo.

PodmanArgs=--privileged
Exec=dockerd -H tcp://0.0.0.0:2375 --tls=false

Volume=/data/forgejo-runner/dind-data:/var/lib/docker:Z

Memory=12G
PidsLimit=8192

[Service]
Restart=always
RestartSec=30
TimeoutStartSec=120

[Install]
WantedBy=default.target

.config__containers__systemd__forgejo_runner.container

[Unit]
Description=Forgejo Actions Runner
Wants=network-online.target
Requires=docker_in_docker.service
After=network-online.target docker_in_docker.service

[Container]
Image=data.forgejo.org/forgejo/runner:12.10.2
ContainerName=forgejo_runner
RunInit=true

Network=runner_internal.network
AddHost=forgejo.example.com:host-gateway

Volume=/data/forgejo-runner/runner-data:/data:Z

Secret=forgejo_runner_token,type=mount,target=/run/secrets/runner-token,uid=1000,mode=0400
Environment=DOCKER_HOST=tcp://docker_in_docker:2375

WorkingDir=/data
Exec=forgejo-runner daemon --config /data/config.yml

Memory=1G
PidsLimit=200

[Service]
Restart=always
RestartSec=30
TimeoutStartSec=120
TimeoutStopSec=35m

[Install]
WantedBy=default.target

.config__systemd__user__dind_firewall.service

[Unit]
Description=Restrict Forgejo runner DinD container egress to host
Requires=docker_in_docker.service
After=docker_in_docker.service
PartOf=docker_in_docker.service

[Service]
Type=oneshot
RemainAfterExit=yes
ExecStart=/bin/sh -c 'for i in $(seq 1 60); do podman exec docker_in_docker iptables -L DOCKER-USER >/dev/null 2>&1 && break; sleep 1; done; \
    podman exec docker_in_docker iptables -L DOCKER-USER >/dev/null 2>&1 || { echo "DOCKER-USER never appeared" >&2; exit 1; }; \
    podman exec docker_in_docker iptables -I DOCKER-USER -d 10.11.12.13 -j DROP; \
    podman exec docker_in_docker iptables -I DOCKER-USER -d 10.11.12.13 -p tcp --dport 443 -j RETURN'

[Install]
WantedBy=default.target

data__forgejo-runner__runner-data__config.yml

log:
  level: info
  job_level: info

runner:
  file: .runner
  capacity: 1
  envs:
    FORGEJO_RUNNER: 1
  timeout: 3h
  shutdown_timeout: 30m
  insecure: false
  fetch_timeout: 30s
  fetch_interval: 10s
  report_interval: 1s
  labels:
    - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest

cache:
  enabled: true
  dir: "/data/cache"

container:
  network: ""
  enable_ipv6: false
  privileged: false
  options: "--add-host=forgejo.example.com:10.11.12.13"
  workdir_parent:
  valid_volumes: []
  docker_host: "tcp://docker_in_docker:2375"
  force_pull: true
  force_rebuild: false

host:
  workdir_parent:

server:
  connections:
    forgejo:
      url: https://forgejo.example.com/
      uuid: 00000000-0000-0000-0000-000000000000
      token_url: file:///run/secrets/runner-token