Runner: reachable actions cache on docker0:8088, allow the workspace bind in valid_volumes

Co-Authored-By: Claude Fable 5.1 <[email protected]>

deploy/runner/config.yaml

@@ -17,6 +17,12 @@ runner:
 cache:
   enabled: true
   dir: /data/cache
+  # The cache server runs inside the runner container. Job containers sit on their own per-job
+  # networks and cannot reach the runner's own network, so the server is published on docker-1's
+  # docker0 address (reachable from every container on the host, not from the LAN) at a fixed port.
+  # Without this every cache restore and save times out after minutes (seen on the first run).
+  host: 172.17.0.1
+  port: 8088
 
 container:
   # The job workspace is a host directory under workdir_parent, mounted into the job container at that
@@ -25,6 +31,9 @@ container:
   bind_workdir: true
   workdir_parent: home/spencerm/gitea/runner/work   # no leading slash; the runner adds it
   privileged: false
-  valid_volumes: []
+  # The workspace bind above is itself a volume the runner must allow, or it is silently ignored
+  # ("is not a valid volume, will be ignored") and the job falls back to a Docker volume.
+  valid_volumes:
+    - /home/spencerm/gitea/runner/work/**
   # The proxy removes what a job started (the CI compose stack included) when the job ends.
   sweep: true