forgejo-virt-runner

forgejo-virt-runner runs every Forgejo Actions job in a fresh, isolated KubeVirt VM that is registered as an ephemeral global runner and deleted after the job. Its artifact cache serves each job only its own repository's entries, and pull requests write only to their own scope. Requires Forgejo >= 16 and KubeVirt.

Quickstart

helm install forgejo-virt-runner \
  oci://git.denktmit.tech/denktmit-oss/charts/forgejo-virt-runner --version <version> \
  --namespace forgejo --create-namespace \
  --set config.forgejoUrl=https://git.example.com \
  --set manager.vmImage=registry.example.com/ci/runner-disk:latest \
  --set config.forgejoTokenSecretRef.name=forgejo-admin-token

• config.forgejoUrl: your Forgejo instance.
• manager.vmImage: KubeVirt containerDisk image (see VM image).
• Forgejo token with scope write:admin: config.forgejoToken or an existing Secret via config.forgejoTokenSecretRef.name (key token).

VM image

The image must contain:

• forgejo-runner >= v12.7.0
• cloud-init (writes /etc/forgejo-runner/config.yaml)
• a systemd unit that runs forgejo-runner one-job --wait -c /etc/forgejo-runner/config.yaml

Components

• forgejo-virt-runner manager: Kubernetes operator that keeps a pool of runner VMs, registers them in Forgejo and cleans up finished, failed or orphaned runners.
• forgejo-virt-runner cache: proxy in front of forgejo-runner cache-server that authenticates each request with the job's runtime token and restricts it to the job's repository and PR scope.

All options: values.yaml.

License

MIT, see LICENSE.