fix: runner stability — add swap, memory limit, and single job concurrency

Prevent OOM crashes by adding 2G swap, limiting job containers to
1536MB memory, and restricting concurrency to one job at a time.
Also configures job containers with gitea host resolution and
disables cache to avoid Docker network connectivity issues.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

playbooks/runner.yml

@@ -89,6 +89,46 @@
           - docker-buildx-plugin
           - docker-compose-plugin
 
+- name: Configure swap on runner.
+  hosts: runner
+  gather_facts: false
+  tasks:
+    - name: Create swapfile.
+      ansible.builtin.command:
+        cmd: fallocate -l 2G /swapfile
+        creates: /swapfile
+
+    - name: Set swapfile permissions.
+      ansible.builtin.file:
+        path: /swapfile
+        mode: "0600"
+
+    - name: Check if swap is active.
+      ansible.builtin.command:
+        cmd: swapon --show=NAME --noheadings
+      register: swap_status
+      changed_when: false
+
+    - name: Format swapfile.
+      ansible.builtin.command:
+        cmd: mkswap /swapfile
+      when: "'/swapfile' not in swap_status.stdout"
+      changed_when: true
+
+    - name: Enable swapfile.
+      ansible.builtin.command:
+        cmd: swapon /swapfile
+      when: "'/swapfile' not in swap_status.stdout"
+      changed_when: true
+
+    - name: Add swapfile to fstab.
+      ansible.posix.mount:
+        path: none
+        src: /swapfile
+        fstype: swap
+        opts: sw
+        state: present
+
 - name: Register and start Gitea runner.
   hosts: runner
   gather_facts: false
@@ -99,11 +139,6 @@
     gitea_hostname: "{{ server_fqdn.value }}"
     gitea_internal_url: "https://{{ gitea_hostname }}"
   tasks:
-    - name: Remove stale runner data.
-      community.docker.docker_volume:
-        name: runner-data
-        state: absent
-
     - name: Create runner data volume.
       community.docker.docker_volume:
         name: runner-data
@@ -116,6 +151,13 @@
         content: |
           runner:
             insecure: true
+            capacity: 1
+          cache:
+            enabled: false
+          container:
+            options: "--add-host {{ gitea_hostname }}:10.0.1.2 --memory=1536m"
+            valid_volumes:
+              - /var/run/docker.sock
 
     - name: Start Gitea runner container.
       community.docker.docker_container: