One runner, one job: parallel CI without sharing the mess

Eleven independent jobs were waiting for one runner. Three isolated Docker hosts fixed capacity; overlapping timestamps proved it, not a green dashboard.

The container runs as root, but cannot write

A root sidecar, an owner-only bind mount and dropped capabilities: why Docker permissions failed, and why the fix was less privilege, not more.