Refactor Dockerfiles for Gitea runners: update package installations, remove obsolete files, and enhance build configurations

ansible/files/dockerfiles/linux-runners/Dockerfile.cicd-base

@@ -2,17 +2,37 @@ FROM local/gitea-runner-base:latest
 
 # cicd-base runner profile: common CI build and release tooling.
 USER root
-RUN apk add --no-cache \
-	bash \
+RUN apt-get update && apt-get install -y --no-install-recommends \
+	buildah \
 	ca-certificates \
 	curl \
+	fuse-overlayfs \
 	git \
+	iptables \
 	jq \
 	make \
 	openssh-client \
+	podman \
 	python3 \
-	py3-pip \
+	python3-pip \
 	rsync \
+	skopeo \
+	slirp4netns \
+	uidmap \
 	unzip \
-	yq \
-	zip
+	zip \
+	&& rm -rf /var/lib/apt/lists/*
+
+RUN mkdir -p /etc/containers /var/lib/containers /run/containers && \
+	printf '%s\n' '[storage]' 'driver = "vfs"' > /etc/containers/storage.conf && \
+	printf '%s\n' '[engine]' > /etc/containers/containers.conf
+
+ENV BUILDAH_ISOLATION=chroot
+ENV STORAGE_DRIVER=vfs
+
+ARG TRIVY_VERSION=0.72.0
+RUN curl -fsSL -o /tmp/trivy.tar.gz \
+	"https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" && \
+	tar -xzf /tmp/trivy.tar.gz -C /tmp && \
+	install -m 0755 /tmp/trivy /usr/local/bin/trivy && \
+	rm -f /tmp/trivy.tar.gz /tmp/trivy

ansible/files/dockerfiles/linux-runners/Dockerfile.cpp-build

@@ -2,9 +2,8 @@ FROM local/gitea-runner-base:latest
 
 # cpp-build runner profile: dedicated C/C++ build environment.
 USER root
-RUN apk add --no-cache \
-	bash \
-	build-base \
+RUN apt-get update && apt-get install -y --no-install-recommends \
+	build-essential \
 	ca-certificates \
 	cmake \
 	curl \
@@ -13,8 +12,8 @@ RUN apk add --no-cache \
 	make \
 	openssh-client \
 	python3 \
-	py3-pip \
+	python3-pip \
 	rsync \
 	unzip \
-	yq \
-	zip
+	zip \
+	&& rm -rf /var/lib/apt/lists/*

ansible/files/dockerfiles/linux-runners/Dockerfile.gitea-runner-base

@@ -1,13 +1,23 @@
-FROM docker.io/gitea/runner:latest
+# Stage 1: Extract the gitea-runner binary from the official Alpine-based image
+FROM docker.io/gitea/runner:latest AS runner
 
-USER root
+# Stage 2: Debian-based image with native glibc support
+FROM debian:bookworm-slim
 
-RUN apk add --no-cache \
+COPY --from=runner /usr/local/bin/gitea-runner /usr/local/bin/gitea-runner
+COPY --from=runner /usr/local/bin/run.sh /usr/local/bin/run.sh
+RUN chmod +x /usr/local/bin/run.sh
+
+ENTRYPOINT ["/usr/local/bin/run.sh"]
+
+RUN apt-get update && apt-get install -y --no-install-recommends \
     bash \
     ca-certificates \
     curl \
     git \
     jq \
+    nodejs \
     openssh-client \
     unzip \
-    zip
+    zip \
+    && rm -rf /var/lib/apt/lists/*

ansible/files/dockerfiles/linux-runners/Dockerfile.go-build

@@ -2,18 +2,17 @@ FROM local/gitea-runner-base:latest
 
 # go-build runner profile: dedicated Go build environment.
 USER root
-RUN apk add --no-cache \
-	bash \
+RUN apt-get update && apt-get install -y --no-install-recommends \
 	ca-certificates \
 	curl \
 	git \
-	go \
+	golang-go \
 	jq \
 	make \
 	openssh-client \
 	python3 \
-	py3-pip \
+	python3-pip \
 	rsync \
 	unzip \
-	yq \
-	zip
+	zip \
+	&& rm -rf /var/lib/apt/lists/*

ansible/files/dockerfiles/linux-runners/Dockerfile.image-build

@@ -1,32 +0,0 @@
-FROM local/gitea-runner-base:latest
-
-# image-build runner profile: dedicated environment for container image builds.
-USER root
-RUN apk add --no-cache \
-	bash \
-	buildah \
-	ca-certificates \
-	curl \
-	fuse-overlayfs \
-	git \
-	iptables \
-	jq \
-	make \
-	openssh-client \
-	podman \
-	python3 \
-	py3-pip \
-	rsync \
-	shadow-uidmap \
-	skopeo \
-	slirp4netns \
-	unzip \
-	yq \
-	zip
-
-RUN mkdir -p /etc/containers /var/lib/containers /run/containers && \
-	printf '%s\n' '[storage]' 'driver = "vfs"' > /etc/containers/storage.conf && \
-	printf '%s\n' '[engine]' > /etc/containers/containers.conf
-
-ENV BUILDAH_ISOLATION=chroot
-ENV STORAGE_DRIVER=vfs

ansible/files/dockerfiles/linux-runners/Dockerfile.infra-tools

@@ -1,28 +0,0 @@
-FROM local/gitea-runner-base:latest
-
-# infra-tools runner profile: Ansible and infrastructure automation tools.
-USER root
-RUN apk add --no-cache \
-		bash \
-		ca-certificates \
-		curl \
-		git \
-		jq \
-		make \
-		openssh-client \
-		python3 \
-		py3-pip \
-		rsync \
-		unzip \
-		yq \
-		zip && \
-		python3 -m venv /opt/infra-venv && \
-		/opt/infra-venv/bin/pip install --no-cache-dir \
-			ansible \
-			ansible-lint \
-			bcrypt \
-			fabric \
-			passlib \
-			pywinrm
-
-ENV PATH="/opt/infra-venv/bin:${PATH}"

ansible/files/dockerfiles/linux-runners/Dockerfile.security-scan

@@ -1,25 +0,0 @@
-FROM local/gitea-runner-base:latest
-
-# security-scan runner profile: image and dependency scanning tooling.
-USER root
-RUN apk add --no-cache \
-	bash \
-	ca-certificates \
-	curl \
-	git \
-	jq \
-	make \
-	openssh-client \
-	python3 \
-	py3-pip \
-	rsync \
-	unzip \
-	yq \
-	zip
-
-ARG TRIVY_VERSION=0.72.0
-RUN curl -fsSL -o /tmp/trivy.tar.gz \
-	"https://github.com/aquasecurity/trivy/releases/download/v${TRIVY_VERSION}/trivy_${TRIVY_VERSION}_Linux-64bit.tar.gz" && \
-	tar -xzf /tmp/trivy.tar.gz -C /tmp && \
-	install -m 0755 /tmp/trivy /usr/local/bin/trivy && \
-	rm -f /tmp/trivy.tar.gz /tmp/trivy