fix act-runner Docker socket for rootless: host path + docker driver

Root cause: docker_host auto-mount resolves paths on the HOST
filesystem, not inside the runner container. Host has rootless
Docker at /run/user/1000/docker.sock, not /var/run/docker.sock.

Fix: docker_host="-" (disable auto-mount) + container.options
mounts the actual host path into job containers.

Also: setup-buildx-action needs driver=docker for rootless Docker
(docker-container driver tries to mount sysfs, blocked in rootless).

.gitea/workflows/deploy.yml

@@ -16,6 +16,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Log in to container registry
         uses: https://github.com/docker/login-action@v3

.gitea/workflows/harden.yml

@@ -17,6 +17,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Log in to container registry
         uses: https://github.com/docker/login-action@v3

.gitea/workflows/infra-ci.yml

@@ -37,6 +37,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build notebooks
         uses: https://github.com/docker/build-push-action@v6
@@ -60,6 +62,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build zotero
         uses: https://github.com/docker/build-push-action@v6
@@ -83,6 +87,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build docs
         uses: https://github.com/docker/build-push-action@v6
@@ -106,6 +112,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build api
         uses: https://github.com/docker/build-push-action@v6
@@ -129,6 +137,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Build mc
         uses: https://github.com/docker/build-push-action@v6

.gitea/workflows/rebuild-all.yml

@@ -15,6 +15,8 @@ jobs:
 
       - name: Set up Docker Buildx
         uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker
 
       - name: Log in to container registry
         uses: https://github.com/docker/login-action@v3

act-runner/config.yaml

@@ -10,7 +10,12 @@ runner:
 
 container:
   network: "ci"
-  privileged: true
+  privileged: false
-  docker_host: unix:///var/run/docker.sock
+  # "-" disables auto-mount (which fails with rootless Docker because
+  # it tries to mount /var/run/docker.sock from the HOST, but the host
+  # socket is at /run/user/1000/docker.sock)
+  docker_host: "-"
+  # Mount the actual HOST socket path into job containers
+  options: "-v /run/user/1000/docker.sock:/var/run/docker.sock"
   valid_volumes:
-    - /**
+    - /run/user/1000/**

dev/scripts/backends/gitea.py

@@ -26,9 +26,13 @@ def _checkout_step() -> str:
 
 
 def _setup_buildx_step() -> str:
+    # Rootless Docker can't use docker-container driver (needs sysfs).
+    # Force the docker driver which uses the existing daemon directly.
     return """\
       - name: Set up Docker Buildx
-        uses: https://github.com/docker/setup-buildx-action@v3"""
+        uses: https://github.com/docker/setup-buildx-action@v3
+        with:
+          driver: docker"""
 
 
 def _setup_uv_step(uv_version: str) -> str: