feat: custom ARC runner image with C toolchain

Thin layer on the official ghcr.io/actions/actions-runner base, adding build-essential so cgo builds (go test -race) work without a per-job apt-get. Includes a build+test+publish workflow, Dependabot for base-image and action-SHA bumps, and operator docs for ARC Helm consumption.

Author: d4rken

.github/dependabot.yml

@@ -0,0 +1,20 @@
+version: 2
+updates:
+  - package-ecosystem: docker
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Europe/Berlin
+    commit-message:
+      prefix: build
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly
+      day: monday
+      time: "04:00"
+      timezone: Europe/Berlin
+    commit-message:
+      prefix: ci

.github/workflows/build.yml

@@ -0,0 +1,95 @@
+name: build runner image
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - Dockerfile
+      - .github/workflows/build.yml
+  pull_request:
+    paths:
+      - Dockerfile
+      - .github/workflows/build.yml
+  schedule:
+    - cron: "37 4 * * 1"   # weekly Mon ~04:37 UTC
+  workflow_dispatch:
+
+concurrency:
+  group: build-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
+
+      - name: Log in to GHCR
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Derive runner version from Dockerfile
+        id: ver
+        run: |
+          version="$(sed -nE 's/^FROM[[:space:]]+ghcr\.io\/actions\/actions-runner:([0-9]+\.[0-9]+\.[0-9]+)([[:space:]]|$).*/\1/p' Dockerfile | head -n1 || true)"
+          if [ -z "${version}" ]; then
+            echo "::error::could not parse runner version from Dockerfile FROM line"
+            exit 1
+          fi
+          echo "runner_version=${version}" >> "$GITHUB_OUTPUT"
+
+      - name: Docker metadata
+        id: meta
+        uses: docker/metadata-action@c299e40c65443455700f0fdfc63efafe5b349051 # v5.10.0
+        with:
+          images: ghcr.io/${{ github.repository }}
+          tags: |
+            type=raw,value=latest,enable={{is_default_branch}}
+            type=raw,value=${{ steps.ver.outputs.runner_version }},enable={{is_default_branch}}
+            type=sha,format=long
+
+      - name: Build and load locally
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
+        with:
+          context: .
+          load: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          platforms: linux/amd64
+
+      - name: Smoke test
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          ref="$(printf '%s\n' "${TAGS}" | head -n1)"
+          docker run --rm --entrypoint bash "${ref}" -lc '
+            set -euo pipefail
+            test "$(id -un)" = runner
+            command -v gcc
+            command -v cc
+            command -v docker
+            test -x "$HOME/run.sh"
+          '
+
+      - name: Push to GHCR
+        if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
+        env:
+          TAGS: ${{ steps.meta.outputs.tags }}
+        run: |
+          set -euo pipefail
+          test -n "${TAGS}"
+          printf '%s\n' "${TAGS}" | while IFS= read -r tag; do
+            [ -n "${tag}" ] || continue
+            docker push "${tag}"
+          done

Dockerfile

@@ -0,0 +1,13 @@
+# Custom GitHub Actions self-hosted runner image for airplanes.live ARC.
+# Official runner image + a C toolchain so cgo builds (e.g. `go test -race`)
+# work without a per-job apt-get. Docker-in-Docker for image builds is a
+# separate concern, handled by `containerMode: dind` in the ARC Helm values,
+# not by this image.
+FROM ghcr.io/actions/actions-runner:2.334.0
+
+USER root
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends \
+        build-essential \
+    && rm -rf /var/lib/apt/lists/*
+USER runner

README.md

@@ -0,0 +1,52 @@
+# actions-runner
+
+Custom GitHub Actions self-hosted runner image for airplanes.live ARC.
+
+Thin layer on top of the official [`ghcr.io/actions/actions-runner`](https://github.com/actions/runner/pkgs/container/actions-runner) base, adding a C toolchain (`build-essential`) so cgo builds (`go test -race`) work without a per-job `apt-get`. The base image ships Docker CLI + Buildx; those are untouched.
+
+We don't use a community runner image (e.g. `catthehacker/ubuntu`) — single-maintainer supply-chain exposure. A pinned Dockerfile on GitHub's official base keeps us on a patched image we control.
+
+## Consuming it in ARC
+
+Two independent knobs need to be set in the `gha-runner-scale-set` Helm values:
+
+1. **Runner image** — the toolchain this repo provides.
+2. **`containerMode: dind`** — a Docker-in-Docker sidecar that provides a Docker daemon for image builds (the runner image only has the client). This is separate from the image.
+
+```yaml
+template:
+  spec:
+    nodeSelector:
+      kubernetes.io/arch: amd64
+    imagePullSecrets:
+      - name: ghcr-pull              # see "GHCR access" below
+    containers:
+      - name: runner                  # ARC requires this name
+        image: ghcr.io/airplanes-live/actions-runner:2.334.0
+        imagePullPolicy: Always       # tag is mutable across rebuilds
+        command: ["/home/runner/run.sh"]
+containerMode:
+  type: dind        # Docker daemon sidecar; requires privileged pods
+```
+
+**Notes:**
+
+- `dind` requires privileged pods — may be blocked by Pod Security Admission or policy engines. Verify the cluster allows it before rolling out.
+- If the dind sidecar itself needs customisation (image, security context), `containerMode` must be replaced with a full pod spec per the [ARC docs](https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners-with-actions-runner-controller/deploying-runner-scale-sets-with-actions-runner-controller#using-docker-in-docker-mode).
+
+## GHCR access
+
+This package is private. ARC pods need an `imagePullSecret` whose token has `read:packages` scope — anonymous pulls fail for private GHCR packages.
+
+Preflight: `docker pull ghcr.io/airplanes-live/actions-runner:<tag>` from a cluster node using the same credentials before switching Helm values.
+
+## Updates
+
+[Dependabot](.github/dependabot.yml) opens PRs weekly:
+
+- **`docker` ecosystem** bumps the `FROM` runner version when GitHub cuts a new release.
+- **`github-actions` ecosystem** bumps the pinned action SHAs in the build workflow.
+
+PR builds validate the image (build + smoke test) without publishing. Merging to `main` triggers a build that publishes to GHCR.
+
+GitHub requires self-hosted runners to stay within ~30 days of the latest release — treat runner-version Dependabot PRs as time-sensitive.