fix(gitea): runner config for caching 2

gitea/compose.yml

@@ -74,6 +74,16 @@ services:
       GITEA_RUNNER_NAME: docker-runner
       GITEA_RUNNER_LABELS: ubuntu-latest:docker://catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://catthehacker/ubuntu:act-20.04
       DOCKER_HOST: unix:///var/run/docker.sock
+    ports:
+      # Fixed cache-server port (see runner-config.yaml's cache.port) so
+      # job containers - isolated on their own per-task Docker network,
+      # unreachable via container name regardless of the `network` setting
+      # below - can still reach it via host.docker.internal, which resolves
+      # to their own network's gateway and routes back to this published
+      # port. Exposed on the VPS's public interface too; consider a
+      # firewall rule restricting it to Docker's private bridge ranges
+      # (172.16.0.0/12) if that's a concern.
+      - "8088:8088"
     volumes:
       - ../.data/gitea/runner:/data
       - /var/run/docker.sock:/var/run/docker.sock

gitea/runner-config.yaml

@@ -15,14 +15,24 @@ runner:
 cache:
   enabled: true
   dir: ""
-  host: "gitea_runner"
-  port: 0
+  # "gitea_runner" (relying on shared networking via container.network below)
+  # didn't work - job containers get their own auto-created per-task network
+  # regardless of container.network (a known act_runner limitation, confirmed
+  # by inspecting a live job container: it was never attached to falcon_network
+  # at all). host.docker.internal resolves to that per-task network's own
+  # gateway instead, which *does* route back to this container's published
+  # port on the host - see https://docs.gitea.com/runner/cache/.
+  host: "host.docker.internal"
+  port: 8088
   external_server: ""
 
 container:
-  network: "falcon_network"
+  network: ""
   privileged: false
-  options: "-v /var/run/docker.sock:/var/run/docker.sock"
+  # --add-host is what makes host.docker.internal (used for cache.host above)
+  # resolve inside job containers on Linux - Docker only wires it up
+  # automatically on Docker Desktop (Mac/Windows), not here.
+  options: "-v /var/run/docker.sock:/var/run/docker.sock --add-host=host.docker.internal:host-gateway"
   workdir_parent: ""
   valid_volumes: []
   docker_host: ""