feat: Add docker compose runner for usda-dash

sw/builders/services.nix

@@ -18,6 +18,13 @@ mkIf builderCfg.giteaRunner.enable {
     tokenFile = builderCfg.giteaRunner.tokenFile;
     labels = builderCfg.giteaRunner.extraLabels;
     name = builderCfg.giteaRunner.name;
+    
+    # Run as engr-ugaif user to access SSH keys
+    settings = {
+      runner = {
+        user = "engr-ugaif";
+      };
+    };
   };
 
   # Configure the systemd service for better handling in LXC containers
@@ -28,29 +35,39 @@ mkIf builderCfg.giteaRunner.enable {
       ConditionPathExists = builderCfg.giteaRunner.tokenFile;
     };
     serviceConfig = {
+      # Run as engr-ugaif user
+      User = mkForce "engr-ugaif";
+      Group = mkForce "users";
+      
       # Give the service more time to stop cleanly
       TimeoutStopSec = mkForce 60;
 
       # Add Node.js and other tools to PATH for GitHub Actions compatibility
       Environment = [
         "PATH=${pkgs.nodejs}/bin:${pkgs.bash}/bin:${pkgs.coreutils}/bin:${pkgs.git}/bin:${pkgs.nix}/bin:/run/current-system/sw/bin"
+        "HOME=/home/engr-ugaif"
       ];
 
       # Disable all namespace isolation features that don't work in LXC containers
+      # Remove systemd security features that conflict with home directory access
+      DynamicUser = mkForce false;
       PrivateMounts = mkForce false;
       MountAPIVFS = mkForce false;
       BindPaths = mkForce [ ];
       BindReadOnlyPaths = mkForce [ ];
+      ReadWritePaths = mkForce [ ];
+      ReadOnlyPaths = mkForce [ ];
+      InaccessiblePaths = mkForce [ ];
       PrivateTmp = mkForce false;
       PrivateDevices = mkForce false;
       ProtectSystem = mkForce false;
       ProtectHome = mkForce false;
-      ReadOnlyPaths = mkForce [ ];
-      InaccessiblePaths = mkForce [ ];
       PrivateUsers = mkForce false;
       ProtectKernelTunables = mkForce false;
       ProtectKernelModules = mkForce false;
       ProtectControlGroups = mkForce false;
+      RestrictAddressFamilies = mkForce [ ];
+      SystemCallFilter = mkForce [ ];
     };
   };
 }