Post Mortem:
The server I run Flotilla, zooid, and other things on got hacked this morning at about 5 AM Pacific. I had disabled the gitea action runner for pull requests, but not for users' own repo...
I am now curious: why was there a docker socket mounted in the first place?