ci: an empty docker_host is how 0.3.x mounts the socket into jobs

`docker_host: automount` is a later act_runner's spelling of the default, and
0.3.1 does not know the word: it exits with `unable to parse docker host
automount` and restart-loops — registered, visible in Gitea, never online, and
the logs say nothing about the config file.

On 0.3.x the empty value is the one that finds a daemon *and* passes it to the
job containers, which is what `docker.yml` needs; `"-"` is the value that
withholds it. Both spellings are now in the guide's failure table, because the
symptom points at the daemon rather than at the one word that caused it.

Verified in the job image on the runner host: Ubuntu 24.04 as root, node 24,
Python 3.12.3, npm, curl and unzip (the SDK script's dependencies), apt-get
update/install, `python3 -m venv` plus pip, `docker version` against the host's
27.5.1 through the mounted socket, and openjdk-21-jdk-headless landing exactly
at the `JAVA_HOME` the Android jobs assume.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

deploy/act-runner.yaml

@@ -34,10 +34,19 @@ container:
   privileged: false
   options:
   workdir_parent: workspace
-  # Mount the host's docker socket into job containers that ask for docker, so
-  # `docker.yml` can build and push. `valid_volumes` is the allow-list that
-  # makes any such mount legal at all.
-  docker_host: automount
+  # How job containers get at a docker daemon, which `docker.yml` needs to build
+  # and push the image.
+  #
+  # **Empty is not "off" here.** In act_runner 0.3.x an empty `docker_host` means
+  # "find a docker host and mount it into the job containers" — which is exactly
+  # what is wanted. `"-"` is the value that finds one for the runner but does
+  # *not* pass it to jobs, and `automount` is a later version's spelling of the
+  # default: on 0.3.1 it fails with `unable to parse docker host automount` and
+  # the daemon restart-loops without ever coming online.
+  docker_host: ""
+  # The allow-list for volumes a workflow or a service container may ask for.
+  # The socket is already mounted by the line above; this is what makes an
+  # explicit mount of it legal too, rather than silently dropped.
   valid_volumes:
     - /var/run/docker.sock
   force_pull: false

docs/gitea-runner.md

@@ -101,10 +101,15 @@ with its labels listed beside it.
 * **`./data`** holds `.runner`: the runner's identity and its permanent token.
   Back it up or do not delete it; removing it makes the runner register again as a
   *new* one and leaves a dead entry behind in Gitea.
-* **`/var/run/docker.sock`** is mounted so a job can build images. With
-  `docker_host: automount` in `config.yaml`, act_runner passes it into the job
-  container too, which is what lets `docker build` work inside a workflow. Treat it
-  as what it is: any workflow on this runner can do anything to this host's docker.
+* **`/var/run/docker.sock`** is mounted so a job can build images. act_runner
+  passes it into the job container too — on 0.3.x that is what an **empty**
+  `docker_host` in `config.yaml` means, not "disabled". Treat the result as what it
+  is: any workflow on this runner can do anything to this host's docker.
+
+  Watch the spelling here. `docker_host: "-"` finds a daemon for the runner but
+  does *not* give it to jobs, and `docker_host: automount` — the same default
+  spelled out, from a later act_runner — makes 0.3.1 exit with `unable to parse
+  docker host automount` and restart-loop, registered but never online.
 * **The shared `gitea-runner` network.** Job containers join the runner's own
   network (`container.network`), because act_runner's built-in cache server — the
   thing that makes `actions/cache@v4` work — advertises its own address, and from
@@ -183,5 +188,6 @@ re-registering is the honest route.)
 | `uses: actions/checkout@v4` fails to resolve | `DEFAULT_ACTIONS_URL` is not `github` |
 | Cache steps hang | Job containers are not on the runner's network — see `container.network` |
 | `docker: command not found` in a job | That image has no docker CLI; use the `catthehacker` one, which does |
-| `Cannot connect to the Docker daemon` in a job | `docker_host: automount` missing from `config.yaml`, or the socket is not mounted into the runner |
+| `Cannot connect to the Docker daemon` in a job | The socket is not mounted into the runner, or `docker_host` is `"-"` (found for the runner, withheld from jobs) |
+| `unable to parse docker host …`, daemon restart-loops | `docker_host` is set to a word this act_runner does not know — `automount` on 0.3.x. Leave it empty |
 | Everything is slow on the first run | It is pulling the job image. It is cached afterwards |