update config for container-in-container builds

build-containers.timer

@@ -4,7 +4,7 @@ Description=Rebuild Forgejo Actions containers
 [Timer]
 OnCalendar=weekly
 Persistent=true
-RandomizedDelaySec=10
+RandomizedDelaySec=10s
 
 [Install]
 WantedBy=timers.target

config.yml

@@ -10,9 +10,8 @@ runner:
   # Execute how many tasks concurrently at the same time.
   capacity: 1
   # Extra environment variables to run jobs.
-  # envs:
-  #   A_TEST_ENV_NAME_1: a_test_env_value_1
-  #   A_TEST_ENV_NAME_2: a_test_env_value_2
+  envs:
+    BUILDAH_ISOLATION: chroot # only possible way to isolate container builds within a container
   # Extra environment variables to run jobs from a file.
   # It will be ignored if it's empty or the file doesn't exist.
   # env_file: .env
@@ -68,7 +67,8 @@ container:
   # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
   privileged: false
   # And other options to be used when the container is started (eg, --add-host=my.forgejo.url:host-gateway).
-  options: "--cpus=1 --memory=1g"
+  # /dev/fuse is needed for the buildah overlayfs storage backend for container builds
+  options: "--cpus=1 --memory=1g --device=/dev/fuse" 
   # The parent directory of a job's working directory.
   # If it's empty, /workspace will be used.
   workdir_parent: