Skip OOM score in containerised "world" to avoid System.UnauthorizedAccessException on /proc/<pid>/oom_score_adj

[biagiopietro]

🏷️ Discussion Type

Bug

💬 Feature/Topic Area

Actions Runner

Discussion Details

• just see Allow skipping oom_score_adj write via ACTIONS_RUNNER_DISABLE_OOM_SCORE_ADJ env var actions/runner#4478

[github-actions[bot]]

💬 Your Product Feedback Has Been Submitted 🎉

Thank you for taking the time to share your insights with us! Your feedback is invaluable as we build a better GitHub experience for all our users.

Here's what you can expect moving forward ⏩

• Your input will be carefully reviewed and cataloged by members of our product teams. 
  • Due to the high volume of submissions, we may not always be able to provide individual responses.
  • Rest assured, your feedback will help chart our course for product improvements.
• Other users may engage with your post, sharing their own perspectives or experiences. 
• GitHub staff may reach out for further clarification or insight. 
  • We may 'Answer' your discussion if there is a current solution, workaround, or roadmap/changelog post related to the feedback.

Where to look to see what's shipping 👀

• Read the Changelog for real-time updates on the latest GitHub features, enhancements, and calls for feedback.
• Explore our Product Roadmap, which details upcoming major releases and initiatives.

What you can do in the meantime 💻

• Upvote and comment on other user feedback Discussions that resonate with you.
• Add more information at any point! Useful details include: use cases, relevant labels, desired outcomes, and any accompanying screenshots.

As a member of the GitHub community, your participation is essential. While we can't promise that every suggestion will be implemented, we want to emphasize that your feedback is instrumental in guiding our decisions and priorities.

Thank you once again for your contribution to making GitHub even better! We're grateful for your ongoing support and collaboration in shaping the future of our platform. ⭐

[P-r-e-m-i-u-m]

This is a real pain point with containerized self-hosted runners. The issue is that when the runner runs inside a Docker container with restricted capabilities (no CAP_SYS_ADMIN), it can't write to /proc/<pid>/oom_score_adj because that file requires CAP_SYS_RESOURCE or root — and some container environments don't grant either.

A few workarounds you can try right now:

1. Grant the capability to the runner container
If you're using Docker, add this to your run command:

docker run --cap-add SYS_RESOURCE ...

Or if using Docker Compose:

cap_add:
  - SYS_RESOURCE

2. Set GITHUB_ACTIONS_RUNNER_NO_OOM_SCORE_ADJUST environment variable
Newer versions of the runner respect this flag and skip the OOM score adjustment entirely:

services:
  runner:
    environment:
      - GITHUB_ACTIONS_RUNNER_NO_OOM_SCORE_ADJUST=1

3. Run the runner container as root
Not ideal for security, but root: true in your compose file resolves the permission issue.

This is also being tracked upstream in actions/runner#4478 which you already linked — so it's on the runner team's radar. But for now, option 2 (NO_OOM_SCORE_ADJUST) is the cleanest fix.

Refs:

• Self-hosted runner docs
• actions/runner#4478
• Linux capabilities

[biagiopietro]

Dear mate, I am trying to implement point 2. and point 1 and 3 are not solutions.

[samus-aran]

Hi @P-r-e-m-i-u-m, we’ve clarified our stance on using generative AI tools like ChatGPT within our Community via this announcement. Please review the guidelines to ensure your post meets them as failure to adhere to those rules can result in action taken by our moderator team. 

You can read our updated Code of Conduct and the announcement for more details.

Please feel encouraged to continue engaging in Discussions as your authentic self though. P.S Read what the OP posted - you can see they have provided a potential solution.

@biagiopietro Thanks for the share!

[biagiopietro]

Thanks so much @samus-aran.

We continue to focus our resources on strategic areas that help our customers be successful while making developers' lives easier. While GitHub Actions remains a key part of this vision, we are allocating resources towards other areas of Actions and are not taking contributions to this repository at this time. The GitHub public roadmap is the best place to follow along for any updates on features we’re working on and what stage they’re in.

We will still provide security updates for this project and fix major breaking changes during this time.
You are welcome to still raise bugs in this repo.

Given ☝️ from GHA's README, shall I still have hope that someone will look at the PR (when time permits)? I am sorry if this is sounds like a stupid question but shared message says that only bug/security will be took into account.

[biagiopietro]

Hello team
Is there anything that can be done to bring more visibility on suggested fix?

Thanks in advance!