Use nested Docker for Actions on the AppArmor-restricted VPS

Hop-State: A_06FN8BBQ8M8RAEV61FS6DM8
Hop-Proposal: R_06FN8B9W0QKY2RYYBYRGEA0
Hop-Task: T_06FN8B4BH4066M2NZTVRZ80
Hop-Attempt: AT_06FN8B4BH4ETR7A6NJS85M0

.hop/records/prompts/P_06FN8B4BH5VT5Q1APW4NQGG.json

@@ -0,0 +1,17 @@
+{
+  "id": "P_06FN8B4BH5VT5Q1APW4NQGG",
+  "task_id": "T_06FN8B4BH4066M2NZTVRZ80",
+  "attempt_id": "AT_06FN8B4BH4ETR7A6NJS85M0",
+  "state_id": "P_06FN8B4BH5VT5Q1APW4NQGG",
+  "prompt": "lets just leave it named as actions, and i think we need to let anyone use it if we are going to try and attract users.",
+  "agent_name": "codex",
+  "status": "proposed",
+  "response_summary": "Use nested Docker for Actions on the AppArmor-restricted VPS",
+  "created_at": "2026-07-12T02:33:53.289398Z",
+  "metadata": {
+    "source_tree": "d17cdaeb6ef87a64399a97279a1d619018e07d1d",
+    "git_commit": "5e754ae297ab71f9591d1f38969bf1979e832da9",
+    "attempt_head": "C_06FN8B8CTKCVTR5Q93FSF5G",
+    "attempt_head_kind": "checkpoint"
+  }
+}

compose.yaml

@@ -47,7 +47,7 @@ services:
     networks: [hopweb]
 
   actions-runner:
-    image: docker.io/gitea/act_runner:latest-dind-rootless
+    image: docker.io/gitea/act_runner:latest-dind
     depends_on:
       gitea:
         condition: service_started
@@ -60,7 +60,7 @@ services:
     cpus: "2.0"
     mem_limit: 4g
     pids_limit: 1024
-    # Required by rootlesskit for the nested Docker daemon. Workflow jobs run
+    # Required by Docker-in-Docker. Workflow jobs run
     # inside that daemon and never receive the host's Docker socket.
     privileged: true
     volumes: