setup-self-hosted-gh-runner

Build a runner image from an ubuntu:24.04 base with the actions-runner tarball and required toolchains, then run it with podman run --rm and config.sh --ephemeral. A supervisor script mints a fresh registration token per spawn via gh api -X POST, and a systemd user service keeps the slots alive.

Use rootless Podman so container root maps to an unprivileged host user via user namespaces, combined with ephemeral containers destroyed after each job. The high-value GitHub PAT stays on the host and only short-lived registration tokens enter containers.

Rootless Podman maps the host user to container uid 0, and the runner refuses to run as root. Fix it by setting the environment variable RUNNER_ALLOW_RUNASROOT=1, passed via podman run -e or baked at the end of the Containerfile.

The runner listener is a .NET 6 app that needs libicu and related libraries. Run ./bin/installdependencies.sh from the /runner directory during image build to install libicu, liblttng-ust, and krb5.

Keep jobs on ubuntu-latest when they need kernel features unavailable in a rootless user namespace, such as FUSE mounts, AppImage, or certain device access. Also skip this setup if the box lacks Podman entirely.

No, concurrent containers on the same volume race on cargo-registry and go-mod writes. Give each slot its own named volume, and mount only pure caches like GOMODCACHE and GOCACHE while keeping toolchain homes in the image.