Add QuickStack runner job image

.gitea/workflows/runner-image.yml

@@ -0,0 +1,79 @@
+name: QuickStack runner job image
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - runner-images/quickstack-job/**
+      - .gitea/workflows/runner-image.yml
+  pull_request:
+    branches:
+      - main
+    paths:
+      - runner-images/quickstack-job/**
+      - .gitea/workflows/runner-image.yml
+  workflow_dispatch:
+
+env:
+  REGISTRY: gitea.nuvisphere.de
+  IMAGE: gitea.nuvisphere.de/nuvisphere/quickstack-job
+  STABLE_TAG: node20-docker27
+  DOCKERFILE: runner-images/quickstack-job/Dockerfile
+  CONTEXT: runner-images/quickstack-job
+
+jobs:
+  build:
+    name: Build and publish runner image
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      packages: write
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Build image
+        run: |
+          set -euo pipefail
+          docker buildx create --name quickstack-runner-image --use || docker buildx use quickstack-runner-image
+          docker buildx build \
+            --load \
+            --progress=plain \
+            --file "$DOCKERFILE" \
+            --tag "$IMAGE:$STABLE_TAG" \
+            "$CONTEXT"
+
+      - name: Verify image tools
+        run: |
+          set -euo pipefail
+          docker run --rm "$IMAGE:$STABLE_TAG" bash -lc '
+            node --version
+            git --version
+            docker --version
+            docker buildx version
+            jq --version
+            curl --version
+            zstd --version
+          '
+
+      - name: Login to Gitea registry
+        if: ${{ gitea.event_name != 'pull_request' }}
+        env:
+          REGISTRY_USERNAME: ${{ secrets.REGISTRY_USERNAME }}
+          REGISTRY_TOKEN: ${{ secrets.REGISTRY_TOKEN }}
+        run: |
+          set -euo pipefail
+          test -n "$REGISTRY_USERNAME"
+          test -n "$REGISTRY_TOKEN"
+          echo "$REGISTRY_TOKEN" | docker login "$REGISTRY" --username "$REGISTRY_USERNAME" --password-stdin
+
+      - name: Publish image
+        if: ${{ gitea.event_name != 'pull_request' }}
+        env:
+          COMMIT_SHA: ${{ gitea.sha }}
+        run: |
+          set -euo pipefail
+          docker tag "$IMAGE:$STABLE_TAG" "$IMAGE:sha-$COMMIT_SHA"
+          docker push "$IMAGE:$STABLE_TAG"
+          docker push "$IMAGE:sha-$COMMIT_SHA"

runner-images/quickstack-job/.dockerignore

@@ -0,0 +1,2 @@
+*
+!Dockerfile

runner-images/quickstack-job/Dockerfile

@@ -0,0 +1,27 @@
+FROM docker:27.5.1-cli AS docker-cli
+
+FROM docker.gitea.com/runner-images:ubuntu-latest-slim
+
+USER root
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+COPY --from=docker-cli /usr/local/bin/docker /usr/local/bin/docker
+COPY --from=docker-cli /usr/local/libexec/docker/cli-plugins/docker-buildx /usr/local/libexec/docker/cli-plugins/docker-buildx
+
+RUN apt-get update \
+  && apt-get install -y --no-install-recommends \
+    ca-certificates \
+    curl \
+    git \
+    jq \
+    openssh-client \
+    zstd \
+  && rm -rf /var/lib/apt/lists/*
+
+RUN node --version \
+  && git --version \
+  && docker --version \
+  && docker buildx version \
+  && jq --version \
+  && zstd --version

runner-images/quickstack-job/README.md

@@ -0,0 +1,29 @@
+# QuickStack Job Runner Image
+
+This image is the small, source-controlled job container used by the Nuvisphere
+Gitea runners for `ubuntu-latest`, `ubuntu-24.04` and `ubuntu-22.04` jobs.
+
+It replaces `docker.gitea.com/runner-images:ubuntu-latest` for QuickStack
+workloads. The full upstream image is large and has caused slow or stuck pulls
+on production runners. This image starts from Gitea's slim Node runner image
+and adds only the tools required by the shared QuickStack OCI workflow:
+
+- Docker CLI and Buildx
+- Git
+- curl
+- jq
+- OpenSSH client
+- CA certificates
+- zstd
+
+The stable production tag is:
+
+```text
+gitea.nuvisphere.de/nuvisphere/quickstack-job:node20-docker27
+```
+
+The publish workflow also pushes an immutable commit tag:
+
+```text
+gitea.nuvisphere.de/nuvisphere/quickstack-job:sha-<commit>
+```