🐛 fix(runners): prevent SIGTERM on docker restart during cloud-init

Remove Requires=docker.service from systemd service files to prevent
systemd from sending SIGTERM to runner services when docker restarts.

Root cause: cloud-init runcmd phase restarts docker for CA cert updates,
which triggers systemd to kill services with Requires=docker.service.

Changes:
- Remove Requires=docker.service from fireteact, fireglab services
- Add After=docker.service to fireactions for consistent ordering
- Add SilenceUsage/SilenceErrors to Cobra for cleaner error output
- Add graceful signal handling to distinguish shutdown from real errors
- Add GetRunnerByName() helper to Gitea client

Author: thpham

fireteact/commands/root.go

@@ -26,6 +26,10 @@ fireactions for GitHub Actions.
 When run without a subcommand, fireteact starts the orchestrator server.
 Use 'fireteact runner' inside a VM to start the runner agent.`,
 	Version: fmt.Sprintf("%s (commit: %s, built: %s)", Version, Commit, Date),
+	// Don't print usage on errors - we handle errors with proper logging
+	SilenceUsage: true,
+	// Don't print errors twice - we log them ourselves
+	SilenceErrors: true,
 }
 
 // Execute adds all child commands to the root command and sets flags appropriately.

fireteact/commands/runner.go

@@ -129,13 +129,23 @@ func runRunner(cmd *cobra.Command, args []string) error {
 	// Register with Gitea
 	log.Info("Registering runner with Gitea...")
 	if err := r.Register(ctx, metadata); err != nil {
+		// Check if this was a signal-induced shutdown (not a real error)
+		if ctx.Err() != nil {
+			log.Info("Registration interrupted by shutdown signal")
+			return nil // Clean exit, not an error
+		}
 		log.Errorf("Failed to register runner: %v", err)
 		return err
 	}
 
 	// Run the runner daemon
 	log.Info("Starting act_runner daemon...")
 	if err := r.Run(ctx); err != nil {
+		// Check if this was a signal-induced shutdown (not a real error)
+		if ctx.Err() != nil {
+			log.Info("Runner stopped by shutdown signal")
+			return nil // Clean exit, not an error
+		}
 		log.Errorf("Runner error: %v", err)
 		return err
 	}

fireteact/internal/gitea/client.go

@@ -272,6 +272,23 @@ func (c *Client) DeleteRunnerByName(ctx context.Context, name string) error {
 	return nil
 }
 
+// GetRunnerByName finds a runner by its name and returns its full status.
+// Returns nil if the runner is not found.
+func (c *Client) GetRunnerByName(ctx context.Context, name string) (*Runner, error) {
+	runners, err := c.ListRunners(ctx)
+	if err != nil {
+		return nil, fmt.Errorf("failed to list runners: %w", err)
+	}
+
+	for _, runner := range runners {
+		if runner.Name == name {
+			return &runner, nil
+		}
+	}
+
+	return nil, nil // Not found
+}
+
 // GetPendingJobs retrieves pending jobs that match the given labels.
 // Note: This is a placeholder - the actual implementation depends on Gitea's API.
 func (c *Client) GetPendingJobs(ctx context.Context, labels []string) ([]Job, error) {

images/docker/ubuntu-24.04/overlay/gitea/etc/systemd/system/fireteact.service

@@ -9,7 +9,6 @@ Documentation=https://github.com/thpham/nixos-fireactions
 # 3. Fireteact starts with CA bundle containing our cert
 # After= is ignored if service doesn't exist (e.g., no cloud-init installed)
 After=network.target cloud-config.service docker.service
-Requires=docker.service
 SuccessAction=reboot
 
 [Service]

images/docker/ubuntu-24.04/overlay/github/etc/systemd/system/fireactions.service

@@ -8,7 +8,7 @@ Documentation=https://github.com/hostinger/fireactions
 #    (workaround for Ubuntu 24.04 bug where ca_certs doesn't update bundle)
 # 3. Fireactions starts with CA bundle containing our cert
 # After= is ignored if service doesn't exist (e.g., no cloud-init installed)
-After=network.target cloud-config.service
+After=network.target cloud-config.service docker.service
 SuccessAction=reboot
 
 [Service]

images/docker/ubuntu-24.04/overlay/gitlab/etc/systemd/system/fireglab.service

@@ -9,7 +9,6 @@ Documentation=https://github.com/thpham/nixos-fireactions
 # 3. Fireglab starts with CA bundle containing our cert
 # After= is ignored if service doesn't exist (e.g., no cloud-init installed)
 After=network.target cloud-config.service docker.service
-Requires=docker.service
 SuccessAction=reboot
 
 [Service]