feat: raise kernel keyring quota on new PVE nodes

Root inside every unprivileged LXC maps to one host user (uid 100000), so all containers on a node share one keyring quota. Docker in the Gitea runner (CT 119) exhausted the 20 KB default, and CI failed with "unable to create session key: disk quota exceeded". Write /etc/sysctl.d/99-keyrings.conf (maxkeys 20000, maxbytes 2000000) on PVE nodes. Already applied by hand to all six current nodes; this covers new and rebuilt ones. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
2026-10-06 23:38:26 -04:00
parent 729835fa99
commit a11e4daaaa
2 changed files with 25 additions and 0 deletions
@@ -9,6 +9,7 @@
 * 📦 Installs essential system packages
 * 📊 Sets up Prometheus Node Exporter (v1.8.2)
 * 🔍 Configures system health monitoring daemon (hwmon)
+* 🔑 Raises the kernel keyring quota on PVE nodes (`/etc/sysctl.d/99-keyrings.conf`) so Docker in unprivileged LXC, like the Gitea CI runner, can keep starting containers
 * ✅ Performs initial dry-run test of monitoring systems

 ## 📋 Prerequisites