security: restrict runner Docker API to pod loopback

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2

manifests/forgejo-runner.yaml

@@ -65,7 +65,7 @@ spec:
         fsGroup: 1000
       initContainers:
         - name: register
-          image: code.forgejo.org/forgejo/runner:6.3.1
+          image: code.forgejo.org/forgejo/runner@sha256:5071e6832313bafe71577e05631bece88caff08fcfb372193e4a21941f4ed54b
           imagePullPolicy: IfNotPresent
           command: ["/bin/sh", "/scripts/register.sh"]
           env:
@@ -88,7 +88,7 @@ spec:
               readOnly: true
       containers:
         - name: dind
-          image: docker:27-dind
+          image: docker.io/library/docker@sha256:aa3df78ecf320f5fafdce71c659f1629e96e9de0968305fe1de670e0ca9176ce
           imagePullPolicy: IfNotPresent
           securityContext:
             privileged: true
@@ -98,15 +98,15 @@ spec:
           args:
             - dockerd
             - -H
-            - tcp://0.0.0.0:2375
+            - tcp://127.0.0.1:2375
             - --tls=false
           readinessProbe:
-            tcpSocket:
-              port: 2375
+            exec:
+              command: ["sh", "-c", "wget -q -O- -T 3 http://127.0.0.1:2375/_ping | grep -qx OK"]
             initialDelaySeconds: 10
             periodSeconds: 10
         - name: runner
-          image: code.forgejo.org/forgejo/runner:6.3.1
+          image: code.forgejo.org/forgejo/runner@sha256:5071e6832313bafe71577e05631bece88caff08fcfb372193e4a21941f4ed54b
           imagePullPolicy: IfNotPresent
           env:
             - name: DOCKER_HOST