From 311aebe21d709466d98e54ab7933712a664f4baa Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Wed, 2 Sep 2026 02:14:37 +0500 Subject: [PATCH 1/2] fix(provider): the runner runs under umask 022 again Since provider .108 every worker, cold or warm, starts its runner from the warm assignment script, and that script runs under umask 077 to keep the phase log and its secrets private. The runner inherited it through exec: every file a job wrote was 0600 and every directory 0700. A job in almaty-libraries that hands a config file to a haproxy container running as uid 99 failed three times from 20:34Z with "wget: bad address": the proxy could not read its config, exited, and Docker's embedded DNS stopped answering for it. The same job had passed at 20:00Z on the last cold worker that cloud-init started, whose runner service ran under 022. Every secret the assignment writes carries an explicit mode, so the script sets umask 022 immediately before it hands over to the runner, in both the direct-JIT and the metadata variants. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp --- internal/garmproviderincus/provider/incus.go | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/internal/garmproviderincus/provider/incus.go b/internal/garmproviderincus/provider/incus.go index 68d24156..ef4268d8 100644 --- a/internal/garmproviderincus/provider/incus.go +++ b/internal/garmproviderincus/provider/incus.go @@ -1041,6 +1041,13 @@ chmod 0700 "${install_script}" # every child Bash process; the assignment itself never exports the token. exec 19>/dev/null export BASH_XTRACEFD=19 +# The assignment's own files are written under umask 077 above. The runner +# is not: a job's checkout has to be readable by the containers the job +# starts, and a haproxy running as uid 99 cannot open a 0600 config the +# runner wrote for it (almaty-libraries, 2026-09-01T20:34Z). Every secret +# this script creates carries an explicit mode, so the default umask is the +# runner's again from here on. +umask 022 /bin/bash "${install_script}" `, metadataURL, encodedToken, encodedCA)) } @@ -1066,6 +1073,14 @@ fi phase_now="$(date +%%s%%N)" [[ "${phase_now}" =~ ^[0-9]{19}$ ]] printf '{"schema_version":1,"phase":"runner-exec","unix_ns":%%s}\n' "${phase_now}" >>"${phase_log}" +# The runner inherits this script's umask through exec. 077 kept the phase +# log and the assignment's secrets private; it also made every file a job +# writes 0600 and every directory 0700, so a container the job starts as +# another uid could not read the config the job had just written for it +# (almaty-libraries' haproxy as uid 99, 2026-09-01T20:34Z, three jobs). +# The systemd runner service GARM's own installer starts runs under 022; +# so does this one. +umask 022 exec "${runner_root}/run.sh" --jitconfig "${JIT_CONFIG}" `, directJITPhasePath, encodedJIT)) } From 1b18036f7a81e81fa08cd7f79befb2b817a67874 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Wed, 2 Sep 2026 02:15:25 +0500 Subject: [PATCH 2/2] chore(provider): release v0.1.5-nddev.109 with the runner's umask restored Source 311aebe21d709466d98e54ab7933712a664f4baa, built twice with CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-buildid= -s -w -X main.version=v0.1.5-nddev.109 -X main.commit="; both builds agree on 4a928b706a2eacbc94909c8978eddb33c5043cea98a728dd1c3ef98f44ddace9. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp --- config/example-runner-1.yaml | 2 +- config/example-runner-2.yaml | 2 +- config/example-runner-3.yaml | 2 +- config/example-runner-4.yaml | 2 +- config/example-services.yaml | 2 +- config/provider-derivative.yaml | 6 +++--- 6 files changed, 8 insertions(+), 8 deletions(-) diff --git a/config/example-runner-1.yaml b/config/example-runner-1.yaml index 058e367f..6fc73e99 100644 --- a/config/example-runner-1.yaml +++ b/config/example-runner-1.yaml @@ -9,7 +9,7 @@ control_plane: manager_version: v0.2.1-nddev.87 scheduling_mode: scale-set provider: incus - provider_version: v0.1.5-nddev.108 + provider_version: v0.1.5-nddev.109 provider_interface: v0.1.0 worker_kind: incus-container runner: actions/runner diff --git a/config/example-runner-2.yaml b/config/example-runner-2.yaml index b0483ce3..a55e797f 100644 --- a/config/example-runner-2.yaml +++ b/config/example-runner-2.yaml @@ -9,7 +9,7 @@ control_plane: manager_version: v0.2.1-nddev.87 scheduling_mode: scale-set provider: incus - provider_version: v0.1.5-nddev.108 + provider_version: v0.1.5-nddev.109 provider_interface: v0.1.0 worker_kind: incus-container runner: actions/runner diff --git a/config/example-runner-3.yaml b/config/example-runner-3.yaml index aba625bb..a051eaf2 100644 --- a/config/example-runner-3.yaml +++ b/config/example-runner-3.yaml @@ -9,7 +9,7 @@ control_plane: manager_version: v0.2.1-nddev.87 scheduling_mode: scale-set provider: incus - provider_version: v0.1.5-nddev.108 + provider_version: v0.1.5-nddev.109 provider_interface: v0.1.0 worker_kind: incus-container runner: actions/runner diff --git a/config/example-runner-4.yaml b/config/example-runner-4.yaml index b712f978..02df6faf 100644 --- a/config/example-runner-4.yaml +++ b/config/example-runner-4.yaml @@ -9,7 +9,7 @@ control_plane: manager_version: v0.2.1-nddev.87 scheduling_mode: scale-set provider: incus - provider_version: v0.1.5-nddev.108 + provider_version: v0.1.5-nddev.109 provider_interface: v0.1.0 worker_kind: incus-container runner: actions/runner diff --git a/config/example-services.yaml b/config/example-services.yaml index 15cc10a8..46e2a45d 100644 --- a/config/example-services.yaml +++ b/config/example-services.yaml @@ -27,7 +27,7 @@ control_plane: manager_version: v0.2.1-nddev.87 scheduling_mode: scale-set provider: incus - provider_version: v0.1.5-nddev.108 + provider_version: v0.1.5-nddev.109 provider_interface: v0.1.0 worker_kind: incus-container runner: actions/runner diff --git a/config/provider-derivative.yaml b/config/provider-derivative.yaml index 55d590e4..cb5c2c74 100644 --- a/config/provider-derivative.yaml +++ b/config/provider-derivative.yaml @@ -16,7 +16,7 @@ artifact: garm-provider-incus # state all move together, because all three derive from here. A provider change # that does not bump it ships under the previous version, which is exactly how # runner-1 and runner-2 diverged. -derivative_version: v0.1.5-nddev.108 +derivative_version: v0.1.5-nddev.109 # The external-provider protocol GARM speaks to this binary. It moves on its own # schedule -- a provider release does not imply an interface release -- so it is @@ -37,8 +37,8 @@ runtime: queue_intent_schema_version: 6 build: - source_commit: d18ce5e4e8bd2ee4633abc0657a1da1838d18cdb - binary_sha256: 99bf1539495cfc40caef7253d43bb8fd6f388419a0b8715207397e07dadb19c0 + source_commit: 311aebe21d709466d98e54ab7933712a664f4baa + binary_sha256: 4a928b706a2eacbc94909c8978eddb33c5043cea98a728dd1c3ef98f44ddace9 go_version: go1.26.6 cgo_enabled: false target_os: linux