Docker

At a glance — a self-hosted launcher that runs each ephemeral runner as a container. Use it when you want per-run isolation on a single host.

Configure

On top of the shared runner-group config:

Variable	Required	Notes
`DOCKER_IMAGE`	Yes	container image for the runner
`DOCKER_SOCKET`	No	`/var/run/docker.sock`
`DOCKER_MEMORY`	No	memory limit (suffixes supported)
`DOCKER_CPUS`	No	CPU limit (positive float)
`DOCKER_CONTAINER_BACKEND_URL`	No	`BACKEND_URL` as seen from inside the container, if the group’s own URL is unreachable there
`DOCKER_IMAGE_PULL_POLICY`	No	`always` \| `missing` \| `never` (default `missing`)
`DOCKER_REGISTRY_AUTH`	No	base64 `X-Registry-Auth` for a private registry

make run_runner_group_docker

How it behaves

The create API never pulls, so a missing image fails every launch unless DOCKER_IMAGE_PULL_POLICY allows a pull.
Finished containers are swept on REAP_INTERVAL (default 5m); tune REAP_GRACE_PERIOD / REAP_KEEP_LATEST_FAILED to keep logs around for post-mortems.

Internals

Configuration → Docker Launcher.