fix(gitea): runner config for caching 3

gitea/compose.yml

@@ -74,16 +74,6 @@ services:
       GITEA_RUNNER_NAME: docker-runner
       GITEA_RUNNER_LABELS: ubuntu-latest:docker://catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://catthehacker/ubuntu:act-20.04
       DOCKER_HOST: unix:///var/run/docker.sock
-    ports:
-      # Fixed cache-server port (see runner-config.yaml's cache.port) so
-      # job containers - isolated on their own per-task Docker network,
-      # unreachable via container name regardless of the `network` setting
-      # below - can still reach it via host.docker.internal, which resolves
-      # to their own network's gateway and routes back to this published
-      # port. Exposed on the VPS's public interface too; consider a
-      # firewall rule restricting it to Docker's private bridge ranges
-      # (172.16.0.0/12) if that's a concern.
-      - "8088:8088"
     volumes:
       - ../.data/gitea/runner:/data
       - /var/run/docker.sock:/var/run/docker.sock
@@ -91,6 +81,11 @@ services:
     restart: always
     networks:
       - compose_network
+      # Job containers join Docker's real "bridge" network (see
+      # runner-config.yaml's container.network) - this container needs to be
+      # on it too so its auto-detected cache-server address is one they can
+      # actually reach.
+      - default_bridge
   db:
     image: postgres:16-alpine
     container_name: gitea_db
@@ -112,3 +107,6 @@ networks:
   compose_network:
     name: ${NETWORK_NAME}
     external: true
+  default_bridge:
+    name: bridge
+    external: true