fix: skip rootless Docker daemon startup in molecule tests

Rootless Docker requires newuidmap/newgidmap kernel support which
doesn't work in nested Docker containers (Operation not permitted).
Added docker_rootless_setup variable (default true) to skip the
daemon startup steps. Set to false in all molecule converge playbooks
so tests verify package installation, user creation, service file
rendering, and config without requiring a working rootless daemon.

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

ansible/roles/gitea-runner/defaults/main.yml

@@ -36,3 +36,5 @@ docker_apt_source_line: >-
   deb [arch={{ docker_apt_arch }} signed-by={{ docker_gpg_key_path }}]
   https://download.docker.com/linux/{{ ansible_facts['distribution'] | lower }}
   {{ ansible_facts['distribution_release'] }} stable
+# Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns)
+docker_rootless_setup: true

ansible/roles/gitea-runner/molecule/default/converge.yml

@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/deregister/converge.yml

@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "deregister-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/lifecycle/converge.yml

@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "lifecycle-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/multi-instance/converge.yml

@@ -7,6 +7,7 @@
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-a"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner
 
@@ -18,5 +19,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "molecule-runner-b"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/template-content/converge.yml

@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "template-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/molecule/update/converge.yml

@@ -7,5 +7,6 @@
     registration_token: "fake-token-for-testing"
     runner_name: "update-test-runner"
     skip_runner_registration: true
+    docker_rootless_setup: false
   roles:
     - role: gitea-runner

ansible/roles/gitea-runner/tasks/rootless_docker.yml

@@ -68,7 +68,9 @@
   become_user: "{{ gitea_runner_service_user }}"
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
-  when: not rootless_docker_check.stat.exists
+  when:
+    - docker_rootless_setup
+    - not rootless_docker_check.stat.exists
 
 - name: Start rootless Docker daemon (systemd user service)
   ansible.builtin.command: systemctl --user start docker
@@ -77,6 +79,7 @@
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
   changed_when: true
+  when: docker_rootless_setup
 
 - name: Enable rootless Docker daemon (systemd user service)
   ansible.builtin.command: systemctl --user enable docker
@@ -85,6 +88,7 @@
   environment:
     XDG_RUNTIME_DIR: "/run/user/{{ gitea_runner_uid }}"
   changed_when: true
+  when: docker_rootless_setup
 
 - name: Wait for rootless Docker daemon to be ready
   ansible.builtin.command: docker version
@@ -98,3 +102,4 @@
   retries: 10
   delay: 2
   changed_when: false
+  when: docker_rootless_setup