From 1b3bb7888badf19473de1043917591c2e3b759d3 Mon Sep 17 00:00:00 2001
From: Zoran Zorica <zoran.zorica@gmail.com>
Date: Fri, 19 Dec 2025 13:12:28 +0100
Subject: [PATCH] feat(runner): download runner binary from API instead of deb
 package

Signed-off-by: Zoran Zorica <zoran.zorica@gmail.com>
---
 runner/main.tf                       |  1 -
 runner/templates/cloud-init.yaml.tpl | 68 ++++++++++++++++++++++------
 runner/variables.tf                  |  6 ---
 3 files changed, 53 insertions(+), 22 deletions(-)

diff --git a/runner/main.tf b/runner/main.tf
index 125ee82..f60dbd2 100644
--- a/runner/main.tf
+++ b/runner/main.tf
@@ -163,7 +163,6 @@ data "cloudinit_config" "runner" {
     content = templatefile("${path.module}/templates/cloud-init.yaml.tpl", {
       daytona_api_url      = var.api_url
       daytona_runner_token = jsondecode(terracurl_request.runner.response).apiKey
-      runner_version       = var.runner_version
       poll_timeout         = var.poll_timeout
       poll_limit           = var.poll_limit
     })
diff --git a/runner/templates/cloud-init.yaml.tpl b/runner/templates/cloud-init.yaml.tpl
index 8057f48..f07078f 100644
--- a/runner/templates/cloud-init.yaml.tpl
+++ b/runner/templates/cloud-init.yaml.tpl
@@ -10,26 +10,64 @@ packages:
   - ca-certificates
 
 write_files:
-  - path: /etc/daytona/runner.env
-    permissions: '0600'
+  - path: /etc/systemd/system/daytona-runner.service
+    permissions: '0644'
     content: |
-      # Daytona Runner Configuration
-      DAYTONA_API_URL=${daytona_api_url}
-      DAYTONA_RUNNER_TOKEN=${daytona_runner_token}
+      [Unit]
+      Description=Daytona Runner Service
+      Documentation=https://github.com/daytonaio/daytona
+      After=network.target
+      Wants=network-online.target
+
+      [Service]
+      Type=simple
+      User=root
+      Group=root
+      WorkingDirectory=/opt/daytona
+
+      # Binary location
+      ExecStart=/opt/daytona/runner
+
+      # Environment values
+      Environment=DAYTONA_API_URL=${daytona_api_url}
+      Environment=DAYTONA_RUNNER_TOKEN=${daytona_runner_token}
+      Environment=DAYTONA_RUNNER_POLL_TIMEOUT=${poll_timeout}
+      Environment=DAYTONA_RUNNER_POLL_LIMIT=${poll_limit}
+
+      # Restart policy
+      Restart=on-failure
+      RestartSec=5s
+
+      # Security hardening
+      NoNewPrivileges=true
+      PrivateTmp=true
+      ProtectSystem=strict
+      ProtectHome=true
+      ReadWritePaths=/var/lib/daytona/runner /var/log/daytona /tmp
+
+      # Resource limits
+      LimitNOFILE=65536
+      LimitNPROC=4096
+
+      # Logging
+      StandardOutput=journal
+      StandardError=journal
+      SyslogIdentifier=daytona-runner
+
+      [Install]
+      WantedBy=multi-user.target
 
-      # Job Polling Configuration
-      DAYTONA_RUNNER_POLL_TIMEOUT=${poll_timeout}
-      DAYTONA_RUNNER_POLL_LIMIT=${poll_limit}
 runcmd:
-  # Download and install Daytona runner
-  - curl -L -o /tmp/daytona-runner.deb "https://download.daytona.io/daytona-ai/runner/daytona-runner_${runner_version}_amd64.deb"
-  - dpkg -i /tmp/daytona-runner.deb || true
+  # Create runner directory
+  - mkdir -p /opt/daytona
 
-  # Enable and start the service
-  - systemctl enable --now daytona-runner
+  # Download runner binary from API
+  - curl -L -f -o /opt/daytona/runner "${daytona_api_url}/runner-amd64"
+  - chmod +x /opt/daytona/runner
 
-  # Clean up
-  - rm -f /tmp/daytona-runner.deb
+  # Reload systemd and enable/start the service
+  - systemctl daemon-reload
+  - systemctl enable --now daytona-runner
 
   # Verify installation
   - systemctl status daytona-runner --no-pager
diff --git a/runner/variables.tf b/runner/variables.tf
index 6f7c122..c5f3597 100644
--- a/runner/variables.tf
+++ b/runner/variables.tf
@@ -71,12 +71,6 @@ variable "runner_name" {
   default     = null
 }
 
-variable "runner_version" {
-  description = "Daytona runner version"
-  type        = string
-  default     = "0.125.0-rc1"
-}
-
 # Runner Configuration (optional)
 variable "poll_timeout" {
   description = "Job polling timeout"