Gitea Runner on Ubuntu 24.04 LTS
by cloudimg
Official Gitea Actions runner that ships connected to nothing and sandboxes every job.
Gitea Actions splits into two halves. Your Gitea instance stores the code, the workflow files and the run history. A runner is the other half: the component that claims a queued job, runs it, streams the log back and cleans up afterwards. Without a runner, workflows queue and nothing happens. Gitea Runner is the official runner, published by the Gitea project, and it speaks the workflow syntax teams already know from GitHub Actions, so existing pipelines are largely portable.
What you get. Gitea Runner 3.5.0 on Ubuntu 24.04 LTS, installed from the project's own release artifact pinned by version and checksum, with Docker Engine from the Ubuntu archive so the container engine receives Ubuntu security updates along with the rest of the system. It runs as an unprivileged, systemd-confined service, executes each job inside its own container, and ships with one small container image already present so a workflow can run without reaching a registry. Connecting it to your instance takes one registration token and a single command.
It ships connected to nothing, and that is the point. A runner image carrying a registration would hand every deployment the same identity, claiming jobs from - and streaming build logs back to - an instance belonging to somebody else, and no later rotation could repair it. This image contains no registration, no runner token and no remembered address, and the service refuses to run until you have told it where to connect. Each instance also generates its own unique runner name on first boot, so two runners on one server never collide.
The job sandbox is set deliberately, not left at its defaults. A runner executes code from anyone who can push to the repositories it serves. Jobs here run in containers that are not handed control of the container engine, cannot bind-mount host directories, cannot run privileged, and cannot reach the Azure instance metadata service, which is where a virtual machine's identity credentials are issued. Nothing but SSH listens on the network, because a runner needs no inbound port at all. An on-instance self test proves all of it by running a real workflow and reading back its own output, and each of its checks is itself tested against a known-bad input first, so a check that has quietly stopped working cannot report success.
Licensing and trademarks. Gitea Runner is free software under the MIT License, with no subscription or licence key. All product and company names are trademarks or registered trademarks of their respective holders; cloudimg is not affiliated with, endorsed by or sponsored by the Gitea project, and packages the unmodified open source software. The cloudimg charge of $0.04 per vCPU/hour covers packaging, hardening and 24/7 support.