github-runner-ubuntu

Repo	box/ubuntu

The canonical, co-tenant-safe Ubuntu CI-runner recipe: the Docker daemon and its GC/socket-heal timers, the CI userns and journald settings, and the runner tree plus ONE parameterised registration script. Extracted from the kind: vm entity that used to carry it as cloud-init, so the SAME recipe serves every substrate (decision D1, opencharly/distro-ubuntu issue 37) — a KubeVirt entity used to have to re-author all of it. Runner REGISTRATION stays an operator step: a token lives one hour and is never committed. charly-register-runners takes the org, name prefix, labels and count, so one script serves a single VM or a multi-VM fleet.

Acceptance plan

This candy’s plan: — the runnable spec charly check executes against a live deployment. check: steps are idempotent probes; run: steps change state.

Intent	Step
run	install /etc/systemd/system/docker-ci.service as 0644
run	install /usr/local/sbin/charly-docker-sock-heal as 0755
run	install /etc/systemd/system/charly-docker-sock-heal.service as 0644
run	install /etc/systemd/system/charly-docker-sock-heal.timer as 0644
run	install /usr/local/sbin/charly-register-runners as 0755
run	install /etc/modules-load.d/charly-ci-netfilter.conf as 0644
run	install /etc/sysctl.d/99-charly-ci-netfilter.conf as 0644
run	install /usr/local/sbin/charly-docker-store-gc as 0755
run	install /etc/systemd/system/charly-docker-store-gc.service as 0644
run	install /etc/systemd/system/charly-docker-store-gc.timer as 0644
run	install /etc/sysctl.d/99-charly-ci-userns.conf as 0644
run	install /etc/systemd/journald.conf.d/charly-ci.conf as 0644
run	step 1 — systemctl enable –now qemu-guest-agent
run	step 2 — install -m 0755 -d /etc/apt/keyrings
run	step 3 — curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/ke
run	step 4 — chmod a+r /etc/apt/keyrings/docker.asc
run	step 5 — printf ’deb [arch=amd64 signed-by=/etc/apt/keyrings/docker.asc] https:
run	step 6 — apt-get update -qq
run	step 7 — DEBIAN_FRONTEND=noninteractive apt-get install -y -qq –allow-downgrad
run	step 8 — apt-mark hold docker-ce docker-ce-cli
run	install the hosted-parity job toolchain at deploy time
run	step 9 — usermod -aG docker ubuntu
run	step 9b — usermod -aG kvm ubuntu (nested virtualisation)
run	step 10 — systemctl disable –now docker.service docker.socket || true
run	step 11 — systemctl daemon-reload
run	step 12 — systemctl enable –now docker-ci.service || true
run	step 13 — ln -sfn /run/docker-ci.sock /var/run/docker.sock
run	step 14 — systemctl enable –now charly-docker-sock-heal.timer || true
run	step 15 — sysctl -p /etc/sysctl.d/99-charly-ci-userns.conf
run	load br_netfilter and apply the netfilter sysctls on this boot
run	step 16 — systemctl daemon-reload
run	step 17 — systemctl enable –now charly-docker-store-gc.timer || true
run	step 18 — systemctl restart systemd-journald || true
run	step 19 — docker version
run	step 20 — curl -fsSL -o /tmp/runner.tgz https://github.com/actions/runner/releas
run	step 21 — install -d -o ubuntu -g ubuntu -m 0755 /home/ubuntu/actions-runner-bas
run	step 22 — tar xzf /tmp/runner.tgz -C /home/ubuntu/actions-runner-base && chown -
run	create the shared Go cache directories
run	write the runner .env with the shared Go cache paths
run	step 23 — if ! swapon –show=NAME | grep -q ‘^/swapfile$’; then fallocate -l 8G
run	step 24 — grep -q ‘^/swapfile’ /etc/fstab || echo ‘/swapfile none swap sw 0 0’ >
check	the co-tenant CI docker daemon is listening on its own socket
check	the CI userns sysctl is applied on the guest
check	the Actions runner agent binary is installed and executable
check	the runner .env points Go at the VM’s shared build/module cache
check	the runner tree carries NO DOCKER_HOST override, so jobs see the default socket
check	the one registration script is installed, executable and self-describing
check	node is installed and reports its version
check	the gh CLI is installed and reports its version
check	pip3 and the archive tools are present
check	the Playwright Chromium runtime packages are installed
check	ruby is installed for the Scripts job’s live smokes
check	skopeo is installed and reports its version
check	the runner user can open /dev/kvm when the CPU exposes virtualisation
check	br_netfilter is loaded and bridge netfilter is enabled