test container

[suzuki-shunsuke]

gh auth refresh -s write:packages

Build the image.
This image's USER isn't a root user.

Dockerfile

FROM debian:bookworm-20240701
RUN apt-get update
RUN apt-get install -y git
RUN useradd -u 1000 foo
USER foo
ENTRYPOINT ["tail", "-f", "/dev/null"]

docker build --platform linux/amd64 -t ghcr.io/suzuki-shunsuke/test-github-action-2:0.0.2 .

Push the image.

docker push ghcr.io/suzuki-shunsuke/test-github-action-2:0.0.2

Change the visibility of the image to public.

https://github.com/users/suzuki-shunsuke/packages/container/test-github-action-2/settings

Run GitHub Actions.

jobs:
  container-test-job:
    runs-on: ubuntu-latest
    permissions:
      packages: read
    container:
      image: ghcr.io/suzuki-shunsuke/test-github-action-2:0.0.2
    steps:
      - run: whoami
      - uses: actions/checkout@v4
      - run: ls -lh

Then actions/checkout failed.

https://github.com/suzuki-shunsuke/test-github-action-2/actions/runs/9986133671/job/27598106195

Run actions/checkout@v4
/usr/bin/docker exec  9f7fdc23f8396e8a33f9c1b024565274c9e3660972500d3020bab139724a6b4f sh -c "cat /etc/*release | grep ^ID"
node:fs:2346
    return binding.writeFileUtf8(
                   ^

Error: EACCES: permission denied, open '/__w/_temp/_runner_file_commands/save_state_3a8fca12-c2c2-4a5b-a1fc-362bff803897'
    at Object.writeFileSync (node:fs:2346:20)
    at Object.appendFileSync (node:fs:2427:6)
    at Object.issueFileCommand (/__w/_actions/actions/checkout/v4/dist/index.js:3039:8)
    at Object.saveState (/__w/_actions/actions/checkout/v4/dist/index.js:2956:31)
    at 4866 (/__w/_actions/actions/checkout/v4/dist/index.js:2407:10)
    at __nccwpck_require__ (/__w/_actions/actions/checkout/v4/dist/index.js:38[17](https://github.com/suzuki-shunsuke/test-github-action-2/actions/runs/9986133671/job/27598106195#step:4:18)3:43)
    at 2565 (/__w/_actions/actions/checkout/v4/dist/index.js:151:34)
    at __nccwpck_require__ (/__w/_actions/actions/checkout/v4/dist/index.js:38173:43)
    at 9210 (/__w/_actions/actions/checkout/v4/dist/index.js:1173:36)
    at __nccwpck_require__ (/__w/_actions/actions/checkout/v4/dist/index.js:38173:43) {
  errno: -13,
  code: 'EACCES',
  syscall: 'open',
  path: '/__w/_temp/_runner_file_commands/save_state_3a8fca12-c2c2-4a5b-a1fc-362bff803897'
}

Node.js v[20](https://github.com/suzuki-shunsuke/test-github-action-2/actions/runs/9986133671/job/27598106195#step:4:21).13.1

Reference

• https://docs.github.com/en/actions/using-workflows/workflow-syntax-for-github-actions#jobsjob_idcontainer
• https://docs.github.com/en/actions/using-jobs/running-jobs-in-a-container
• https://docs.github.com/en/packages/working-with-a-github-packages-registry/working-with-the-container-registry
• [BUG] This action inside a workflow executed inside a container doesn't work suzuki-shunsuke/github-action-terraform-init#19
• Experiencing permission denied after v3.1.0 on jobContainers when container user is not 'root' actions/checkout#956