Repository navigation
feat(cluster): start the container runtime at login on macOS hosts - #102
Merged
Merged
Conversation
A filter that tells Colima, Docker Desktop and any other runtime apart from the Docker context the role drives, and which Colima profile a context belongs to, with the runtime and profile overridable for hosts whose context does not say. It refuses a profile that names another VM than the context, and any profile name that is not a valid Lima instance name.
…time A reboot leaves a Mac's container runtime stopped, so the node's k3s container never comes back and a cluster that loses two such hosts loses quorum. On a macOS host whose Docker context is Colima, the role now starts the profile if it is stopped, installs a per-user launchd agent that starts it at every login with a PATH naming both Homebrew prefixes, and loads the agent into the connecting user's login session. Docker Desktop cannot be started by the role, so there the start-at-login setting is documented. The runtime tasks run before anything reads the daemon, and end checks after the Compose project is started assert that the runtime answers and the node's k3s container is running, so a converge of a rebooted host repairs it or fails with a message that says what to do. Linux hosts are not touched, and --check and --diff show what would change without starting anything. github_runner_cluster_runtime_autostart turns the whole thing off. The node's container name is now derived once as github_runner_cluster_node_container and shared with the running-version check.
…thered facts The macOS conditions read os_family from ansible_facts, which a play with gather_facts: false does not have, so the role failed on every host of such a play right after its first tasks. The role now reads the kernel name with the platform subset of setup when the caller has not gathered it, and the runtime tasks gather the connecting user and environment they use the same way. The conditions test the kernel name, Darwin, instead of the OS family.
Mearman
marked this pull request as ready for review
October 20, 2026 11:15
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
|
This security review couldn’t start because the paying account has exhausted its Codex allowance and has insufficient available credits. The payer can check their balance and add credits in the Codex usage dashboard, then try again. If you do not manage the paying account, contact this repository's admins. |
|
🎉 This PR is included in version 2.1.0 🎉 The release is available on:
Your semantic-release bot 📦🚀 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The cluster role now makes a macOS host's container runtime come back after a reboot. On a host whose Docker context is Colima (
colimaorcolima-<profile>), it starts the profile if it is stopped, installs a per-user launchd agent that starts it at every login, and loads that agent into the connecting user's login session. The agent's PATH names both Homebrew prefixes, and it starts the profile with--activate=falseso the host's current Docker context is not changed. Docker Desktop cannot be started by the role, so its start-at-login setting is documented in the role README.The runtime tasks run before anything reads the daemon. End checks after the Compose project is started assert that the runtime answers and the node's k3s container is running, so converging a host that rebooted repairs it or fails with a message that says what to do. Linux hosts are not touched, and
--check --diffshow the property list that would be written without starting anything.github_runner_cluster_runtime_autostart(default true) turns it on for Colima hosts only;github_runner_cluster_runtime,github_runner_cluster_colima_profileandgithub_runner_cluster_runtime_pathcover hosts whose context does not say which runtime they run. The node's container name is now derived once asgithub_runner_cluster_node_containerand shared with the running-version check.Fixes #98
Tested locally with
ansible-lint --profile production,yamllint ., the playbook syntax checks and the unit suite (python3 -m unittest discover -s tests/unit), including new tests that render the launchd agent, check the variable defaults and the macOS-only guard, and run the runtime and end-check tasks against stand-ins fordocker,colima,launchctlandplutil(start, idempotence, check mode, no login session, Docker Desktop, a stopped container).Not tested: no real Mac, Colima, Docker Desktop or launchd session was used, so loading the agent into a real login session and the agent running at a real reboot are untested.