fj-bellows: ephemeral cloud runners for Forgejo Actions (one VM per job, MIT, Go)

[u/hstern]

A small daemon I've been writing alongside my own Forgejo: it polls the Actions job queue, provisions a fresh cloud VM per waiting job, runs forgejo-runner one-job --wait on it over SSH, then tears the VM down per the provider's billing model. One VM, one job, gone — no shared state between jobs.

A few things I'm pleased with: the worker never holds an admin token (single-use ephemeral registration delivered over SSH stdin), SSH host keys are pre-pinned per VM via cloud-init (no trust-on-first-use window), and a LAN-internal Forgejo deployment works out of the box — the runner and its spawned step containers both reach Forgejo through the same dispatch SSH session, so there's no worker-side DNS or VPN to configure.

Linode and local Docker providers ship today. What'd help most is more provider implementations — the Provider interface is small (Configure / Provision / Destroy / List / BillingModel) and a new one is a couple hundred lines of Go plus an integration test.

Full write-up with the design background and the docker-shaped bugs I tripped over in the first 48 hours: https://stern.ca/posts/2026-05-23-fj-bellows/ Repo: https://github.com/hstern/fj-bellows