Correct bind mountsJobs run their own dockerd, so "$PWD" and Compose bind mounts resolve inside the runner instead of silently mounting empty host paths.
One admin CLIfleet.sh generates Compose from orgs.conf, builds default and per-org images, updates runner versions, and manages the lifecycle.
No host socketThe host Docker socket is never mounted; each runner is a self-contained build box with its own image cache.
One-command installbootstrap.sh sets up a fresh Ubuntu host, collects secrets, builds the image, and starts the fleet.
Per-org imagesPoint an organization at a context folder with a Dockerfile and it gets its own runner image.
Version updatesupdate-runners resolves the latest Actions runner release, rebuilds every image, and recreates the fleet.