qa/self-hosted labels run jobs directly in the runner container (Alpine), which lacked a docker client despite the mounted host socket.
Compose service registers against git.wampler.us via act_runner, mounts docker.sock for job execution. Secrets and runtime state (.env, data/) kept out of git. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>