fix(provider): .109 runs the runner under umask 022 - #354
Merged
Conversation
Since provider .108 every worker, cold or warm, starts its runner from the warm assignment script, and that script runs under umask 077 to keep the phase log and its secrets private. The runner inherited it through exec: every file a job wrote was 0600 and every directory 0700. A job in almaty-libraries that hands a config file to a haproxy container running as uid 99 failed three times from 20:34Z with "wget: bad address": the proxy could not read its config, exited, and Docker's embedded DNS stopped answering for it. The same job had passed at 20:00Z on the last cold worker that cloud-init started, whose runner service ran under 022. Every secret the assignment writes carries an explicit mode, so the script sets umask 022 immediately before it hands over to the runner, in both the direct-JIT and the metadata variants. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
…tored Source 311aebe, built twice with CGO_ENABLED=0 go build -trimpath -buildvcs=false -ldflags "-buildid= -s -w -X main.version=v0.1.5-nddev.109 -X main.commit=<source>"; both builds agree on 4a928b706a2eacbc94909c8978eddb33c5043cea98a728dd1c3ef98f44ddace9. Claude-Session: https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Provider v0.1.5-nddev.109. Since .108 every worker starts its runner from the warm assignment script, which runs under umask 077; the runner inherited it, so every file a job wrote was 0600 and a container the job started as another uid could not read the config written for it (almaty-libraries' haproxy as uid 99: three failures from 20:34Z, 'wget: bad address'). The script now sets umask 022 right before it hands over to the runner, in both assignment variants. Reproducible build from the source commit in the manifest.
https://claude.ai/code/session_0128syXKxAGCfJGRDxUUNQXp