fix: persist rootless Docker unit environment

CHANGELOG.md

@@ -2,6 +2,7 @@
 
 ## Не выпущено
 
+- Runner installer сохраняет `HOME` и XDG-пути в user-unit `docker.service` и проверяет применённое окружение после запуска.
 - Runner installer защищает image и mountpoint root-owned home-каталогом, оставляет регистрацию и workspace в runner-owned каталоге, безопасно форматирует образ по открытому FD и проверяет `nosuid,nodev`.
 - Backend `0.11.3`: ключ подписи поисковых снимков читается из Docker secret-файла, а не из аргументов процесса. Добавлена базовая инфраструктура VPS, Caddy HTTPS proxy с разделёнными Compose-сетями и CI-проверка конфигурации; публикация образов и production-деплой остаются выключены до проверки runner, registry, backup/restore и ограниченного deploy-helper.
 - Frontend `0.1.2`: на планшетной ширине экран поиска переходит в одну колонку, чтобы фильтры, результаты и документ помещались в окно.

docs/operations/CURRENT_STATE.md

@@ -96,9 +96,10 @@ UFW rule details, and protected file metadata remain unverified.
   `0755` config directories, creates the image through a pinned file descriptor,
   rejects path replacement, and requires mount options `nosuid,nodev`.
   The reported installation blocker is that rootless setup receives this
-  protected directory as `HOME`; the fix prepared in this PR assigns writable
-  runner-owned HOME/XDG paths and checks them before setup. It has not been
-  merged or run on the VPS.
+  protected directory as `HOME`; the installer assigns writable runner-owned
+  HOME/XDG paths, persists them in the `docker.service` user-unit drop-in, and
+  checks the effective unit environment after startup. Local runner guards pass;
+  the change has not been run on the VPS.
 - Gitea repository runner inventory could not be read by the current API
   principal (403). The owner has not supplied runner state, and no runner
   Online status or runner-hosted workflow is claimed. The manual

infra/runner/install-runner.sh

@@ -145,6 +145,12 @@ TasksMax=1024
 Restart=always
 RestartSec=5
 EOF
+runner_install_user_content "$runner_home/.config/systemd/user/docker.service.d/environment.conf" "$runner_user" "$runner_user" 0644 <<EOF
+[Service]
+Environment=HOME=$runner_runtime_home
+Environment=XDG_CONFIG_HOME=$runner_xdg_config_home
+Environment=XDG_DATA_HOME=$runner_xdg_data_home
+EOF
 runner_install_content /etc/systemd/system/akyldash-act-runner.service root root 0644 <<EOF
 [Unit]
 Description=AkylDash repository Gitea Actions runner
@@ -214,7 +220,6 @@ systemctl start "user@$runner_uid.service"
 rootless_docker_unit="$runner_xdg_config_home/systemd/user/docker.service"
 rootless_env=(HOME="$runner_runtime_home" XDG_CONFIG_HOME="$runner_xdg_config_home" XDG_DATA_HOME="$runner_xdg_data_home" XDG_RUNTIME_DIR="/run/user/$runner_uid" DBUS_SESSION_BUS_ADDRESS="unix:path=/run/user/$runner_uid/bus")
 runuser -u "$runner_user" -- env "${rootless_env[@]}" sh -c 'test -w "$HOME" && test -w "$XDG_CONFIG_HOME" && test -w "$XDG_DATA_HOME"' || die 'rootless Docker HOME and XDG directories must be writable by the runner'
-runuser -u "$runner_user" -- env "${rootless_env[@]}" systemctl --user set-environment "HOME=$runner_runtime_home" "XDG_CONFIG_HOME=$runner_xdg_config_home" "XDG_DATA_HOME=$runner_xdg_data_home"
 if [[ -e $rootless_docker_unit || -L $rootless_docker_unit ]]; then
   [[ -f $rootless_docker_unit && ! -L $rootless_docker_unit && $(stat -c %U "$rootless_docker_unit") == "$runner_user" ]] || die 'existing rootless Docker unit has an unexpected type or owner'
   grep -Fq 'dockerd-rootless.sh' "$rootless_docker_unit" || die 'existing rootless Docker unit differs from the expected service'
@@ -223,5 +228,9 @@ else
 fi
 runuser -u "$runner_user" -- env "${rootless_env[@]}" systemctl --user daemon-reload
 runuser -u "$runner_user" -- env "${rootless_env[@]}" systemctl --user enable --now docker.service
+docker_environment=$(runuser -u "$runner_user" -- env "${rootless_env[@]}" systemctl --user show docker.service --property=Environment --value)
+for expected in "HOME=$runner_runtime_home" "XDG_CONFIG_HOME=$runner_xdg_config_home" "XDG_DATA_HOME=$runner_xdg_data_home"; do
+  [[ " $docker_environment " == *" $expected "* ]] || die "rootless Docker unit is missing $expected"
+done
 
 printf '\nRunner runtime installed. Register it interactively, then enable its services as described in docs/operations/CI_RUNNER.md.\n'

infra/runner/test-runner-config.sh

@@ -23,6 +23,13 @@ grep -Fq 'test -w "$HOME" && test -w "$XDG_CONFIG_HOME" && test -w "$XDG_DATA_HO
 grep -Fq 'rootless_env=(HOME="$runner_runtime_home" XDG_CONFIG_HOME="$runner_xdg_config_home" XDG_DATA_HOME="$runner_xdg_data_home"' "$installer"
 grep -Fq 'Environment=XDG_CONFIG_HOME=$runner_xdg_config_home' "$installer"
 grep -Fq 'Environment=XDG_DATA_HOME=$runner_xdg_data_home' "$installer"
+grep -Fq 'runner_home/.config/systemd/user/docker.service.d/environment.conf' "$installer"
+grep -Fq 'Environment=HOME=$runner_runtime_home' "$installer"
+grep -Fq 'systemctl --user show docker.service --property=Environment --value' "$installer"
+if grep -Fq 'systemctl --user set-environment' "$installer"; then
+  echo 'Rootless Docker environment must persist in its user unit drop-in' >&2
+  exit 1
+fi
 grep -Fq 'HOME=/var/lib/akyldash-runner/.config/act-runner' infra/runner/act-runner-healthcheck.sh
 grep -Fq 'XDG_CONFIG_HOME=/var/lib/akyldash-runner/.config' infra/runner/act-runner-healthcheck.sh
 grep -Fq 'XDG_DATA_HOME=/var/lib/akyldash-runner/.config/act-runner/.local/share' infra/runner/act-runner-healthcheck.sh