From 1cc16241879f0c84f01fbdbb5f6b93156c220cf7 Mon Sep 17 00:00:00 2001
From: casjay <git-admin@casjaysdev.pro>
Date: Fri, 5 Jun 2026 17:06:16 -0400
Subject: [PATCH] =?UTF-8?q?=F0=9F=90=9B=20Remove=20:host=20runner=20labels?=
 =?UTF-8?q?=20=E2=80=94=20all=20jobs=20must=20run=20in=20containers=20?=
 =?UTF-8?q?=F0=9F=90=9B?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

:host labels run jobs directly on the container filesystem with no
isolation. Replace all arch-specific :host labels with
:docker://ubuntu:latest so every job runs inside its own container
regardless of the runner host architecture.
- rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh: amd64/arm64/linux labels use docker://ubuntu:latest not :host
- README.md: remove :host from external runner label examples

README.md
rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
---
 README.md                                           | 9 +++++----
 rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh | 6 +++---
 2 files changed, 8 insertions(+), 7 deletions(-)

diff --git a/README.md b/README.md
index 41075e2..3d510d6 100644
--- a/README.md
+++ b/README.md
@@ -203,13 +203,14 @@ act_runner register \
   --instance https://git.example.com \
   --token    <registration-token> \
   --name     "arm64-server" \
-  --labels   "arm64:host,linux/arm64:host,ubuntu:docker://ubuntu:latest,alpine:docker://alpine:latest" \
+  --labels   "arm64:docker://ubuntu:latest,linux/arm64:docker://ubuntu:latest,alpine:docker://alpine:latest,debian:docker://debian:latest" \
   --no-interactive
 ```
 
-Label format: `name:type` or `name:type:image`
-- `arm64:host` — runs jobs natively on this machine
-- `ubuntu:docker://ubuntu:latest` — spins a Docker container per job (requires Docker on the host)
+Label format: `name:type:image` — all jobs run inside Docker containers, never directly on the host.
+- `arm64:docker://ubuntu:latest` — dispatched to this runner, job runs in a native arm64 Ubuntu container
+- `linux/arm64:docker://ubuntu:latest` — OCI-style label for the same runner
+- Docker must be installed and running on the host machine
 
 ### 4 — Run as a systemd service
 
diff --git a/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh b/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
index 76229ff..f320377 100755
--- a/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
+++ b/rootfs/usr/local/etc/docker/init.d/zz-act_runner.sh
@@ -270,9 +270,9 @@ case "$_HOST_ARCH" in
   aarch64) _ARCH_LABEL="arm64" ;;
   *)       _ARCH_LABEL="$_HOST_ARCH" ;;
 esac
-RUNNER_LABELS="${_ARCH_LABEL}:host,"
-RUNNER_LABELS+="linux:host,"
-RUNNER_LABELS+="linux/${_ARCH_LABEL}:host,"
+RUNNER_LABELS="${_ARCH_LABEL}:docker://ubuntu:latest,"
+RUNNER_LABELS+="linux:docker://ubuntu:latest,"
+RUNNER_LABELS+="linux/${_ARCH_LABEL}:docker://ubuntu:latest,"
 RUNNER_LABELS+="node14:docker://node:14,"
 RUNNER_LABELS+="node16:docker://node:16,"
 RUNNER_LABELS+="node18:docker://node:18,"