.gitea/workflows/images.yml

@@ -11,18 +11,24 @@ on:
     tags: ['v*.*.*']
   workflow_dispatch:
 
+# Jobs that run docker builds use dejima-privileged; anything else should use
+# dejima-confined.
 jobs:
   build:
-    runs-on: ubuntu-latest
+    name: ${{ matrix.name }}
+    runs-on: dejima-privileged
     strategy:
       fail-fast: false
       matrix:
         include:
-          - image: dotcom-arcade
+          - name: app
+            image: dotcom-arcade
             context: .
-          - image: dotcom-arcade-session-manager
+          - name: session-manager
+            image: dotcom-arcade-session-manager
             context: streaming/session-manager
-          - image: dotcom-arcade-streamer
+          - name: streamer
+            image: dotcom-arcade-streamer
             context: streaming/streamer
     steps:
       - uses: actions/checkout@v4

docs/09-deployment/docker-deployment.md

@@ -43,7 +43,9 @@ Then run `docker compose pull && docker compose up -d`.
 `.gitea/workflows/images.yml` builds all three images on Gitea Actions and
 pushes them to the Gitea instance's container registry, under the repository's
 owner. Pushes to `main` publish a `main` tag; `v1.2.3` tags publish `1.2.3`,
-`1.2` and `latest`. It needs two repository secrets:
+`1.2` and `latest`. Its jobs run docker builds, so they need a runner labelled
+`dejima-privileged`; jobs that don't build images should use `dejima-confined`.
+It also needs two repository secrets:
 
 - `REGISTRY_USERNAME`: a user;
 - `REGISTRY_TOKEN`: an access token of theirs with package write access.