GRM-152: fix: fetch rootless Docker scripts on Arch Linux

ansible/roles/gitea_runner/defaults/main.yml

@@ -54,6 +54,16 @@ gitea_runner_docker_apt_source_line: >-
 # Set to false in CI/molecule to skip rootless daemon startup (needs kernel userns)
 gitea_runner_docker_rootless_setup: true
 
+# Rootless Docker helper scripts (dockerd-rootless-setuptool.sh / dockerd-rootless.sh).
+# Arch Linux's "docker" package does not ship these (unlike Debian's docker-ce-rootless-extras),
+# and no official Arch package provides them. They are fetched from the upstream moby/moby
+# "contrib/" directory at the git ref below. The scripts are stable bash wrappers that are
+# version-agnostic with respect to the dockerd binary, so a pinned ref is safe.
+gitea_runner_rootless_scripts_ref: "v28.5.1"
+# Install dir MUST match the location of the "docker" / "dockerd" / "rootlesskit" binaries so
+# that dockerd-rootless-setuptool.sh (which derives BIN from its own dirname) finds them co-located.
+gitea_runner_rootless_scripts_install_dir: "/usr/bin"
+
 # Rootless Docker network driver: "pasta" (IPv6 support) or "slirp4netns" (IPv4 only)
 # pasta has proper outgoing IPv6 support; slirp4netns does not (known limitation).
 gitea_runner_docker_rootless_net_driver: "pasta"

ansible/roles/gitea_runner/tasks/rootless_docker.yml

@@ -62,9 +62,29 @@
       - passt
       - fuse-overlayfs
       - rsync
+      # rootlesskit is the userspace networking/namespace driver for rootless Docker.
+      # It is NOT a dependency of the "docker" package on Arch and must be installed explicitly.
+      - rootlesskit
     state: present
   when: ansible_facts['os_family'] == 'Archlinux'
 
+# Arch Linux's "docker" package does not ship the rootless setup scripts (dockerd-rootless-setuptool.sh
+# and dockerd-rootless.sh), unlike Debian/Ubuntu's docker-ce-rootless-extras. No official Arch package
+# provides them, so fetch them from the upstream moby/moby contrib/ directory. They are installed
+# alongside the docker binaries (/usr/bin) because dockerd-rootless-setuptool.sh derives its BIN
+# directory from its own location and expects docker/dockerd/rootlesskit to be co-located there.
+- name: Fetch rootless Docker setup scripts (Arch Linux)
+  ansible.builtin.get_url:
+    url: "https://raw.githubusercontent.com/moby/moby/{{ gitea_runner_rootless_scripts_ref }}/contrib/{{ item.name }}"
+    dest: "{{ gitea_runner_rootless_scripts_install_dir }}/{{ item.name }}"
+    mode: "0755"
+    owner: root
+    group: root
+  loop:
+    - name: dockerd-rootless-setuptool.sh
+    - name: dockerd-rootless.sh
+  when: ansible_facts['os_family'] == 'Archlinux'
+
 - name: Check if rootless Docker is already set up
   ansible.builtin.stat:
     path: "{{ gitea_runner_home }}/.config/systemd/user/docker.service"