Preserve runner runtime path carve-out

docs/operations/CI_RUNNER.md

@@ -25,12 +25,10 @@ rootless Docker setup and user service use `.config/act-runner` as writable
 `.config/act-runner/.local/share` as `XDG_DATA_HOME`. This keeps Docker config
 and its systemd user unit in the existing `.config` tree without granting
 write access to the protected home.
-The runner systemd unit uses `ProtectHome=read-only`: `/home`, `/root`, and
-`/run/user` remain visible read-only. `ReadWritePaths` does not make
-`/run/user/$uid` writable, because read-only mounts still permit communication
-with existing Unix sockets; this lets the runner connect to
-`/run/user/$uid/docker.sock` without write access to the runtime directory.
-`ProtectHome=yes` would hide `/run/user` and break that socket path. See the
+The runner systemd unit uses `ProtectHome=read-only` so `/run/user` remains
+visible; `ReadWritePaths` retains the existing `/run/user/$uid` writable
+carve-out for the runner's rootless runtime. `ProtectHome=yes` would hide
+`/run/user` and break the configured runtime and Docker socket paths. See the
 [systemd.exec documentation](https://www.freedesktop.org/software/systemd/man/255/systemd.exec.html#ProtectHome=).
 The rootless Docker daemon and runner user are separate from production Docker;
 `codex` is not added to

docs/operations/CURRENT_STATE.md

@@ -116,9 +116,9 @@ protected file metadata remain unverified.
   `akyldash-runner` with `ProtectHome=read-only`; `ReadWritePaths` includes the
   runner runtime/config/log paths and `/run/user/999`. Its `ExecStart` uses
   `/etc/akyldash-runner/config.yaml`. The live unit retains a writable carveout
-  for `/run/user/999`; the installer change in this branch removes that
-  carveout while keeping the socket visible over the read-only path. No VPS
-  unit was changed. Main commit
+  for `/run/user/999`; the installer keeps that existing carveout and changes
+  `ProtectHome` from `yes` to `read-only` so the runtime path remains visible.
+  No VPS unit was changed. Main commit
   `d2fb4b81` passed CI run 115 and smoke run 116. On
   head `3a89dc21`, CI run 63 failed at the host audit root guard and smoke run 64
   succeeded. On head `436806a8`, CI run 65 failed in the Caddy container action

infra/runner/install-runner.sh

@@ -184,7 +184,7 @@ ProtectKernelTunables=yes
 ProtectKernelModules=yes
 ProtectKernelLogs=yes
 RestrictSUIDSGID=yes
-ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner
+ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner /run/user/$runner_uid
 StandardOutput=append:/var/log/akyldash-runner/act_runner.log
 StandardError=append:/var/log/akyldash-runner/act_runner.log
 

infra/runner/test-runner-config.sh

@@ -45,8 +45,8 @@ if grep -Fq 'env HOME="$runner_home"' "$installer"; then
   exit 1
 fi
 grep -Fq 'die '\''stop akyldash-act-runner.service after all jobs finish before rerunning this installer' "$installer"
-grep -Fq 'ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner' "$installer"
-assert_absent 'ReadWritePaths=.*(/run/user/|docker.sock)' "$installer"
+grep -Fq 'ReadWritePaths=$runner_runtime_home $runner_xdg_config_home /var/log/akyldash-runner /run/user/$runner_uid' "$installer"
+assert_absent 'ReadWritePaths=.*(/var/run/docker.sock|/run/docker.sock)' "$installer"
 grep -Fq 'os.O_NOFOLLOW | os.O_CLOEXEC' infra/runner/secure-runner-image.py
 grep -Fq 'os.posix_fallocate(image_fd, 0, int(bytes_text))' infra/runner/secure-runner-image.py
 grep -Fq 'pass_fds=(image_fd,)' infra/runner/secure-runner-image.py