-
Notifications
You must be signed in to change notification settings - Fork 15
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Can't run with no-new-privileges #11
Comments
The docker-gitea-act-runner/image/run.sh Line 30 in 14e7184
Given that, it's likely not compatible with docker's Disclaimer: I am no expert on docker. This is my opinion based on 10 minutes of research into the |
That might very well be the culprit but also looks like a hack at first sight (I'm also not a docker expert). See for example the following blog post on how things should be done instead of usermod/groupmod: https://vsupalov.com/docker-shared-permissions/ I would assume GITEA_RUNNER_GID and GITEA_RUNNER_UID could very well be the group and user the container is running on (and not different from it). |
This is actually an unsolved issue in docker world. There are countless blog posts reasoning about it. All existing workarounds/solutions are either hacks and/or have limitations one way or another. This issue has been raised with Docker Inc. 9 years ago and was closed with a rather non-practical solution. Besides setting uid/gid at container build time or running a container with |
Additionally, for the docker-out-of-docker approach ( docker-gitea-act-runner/image/run_fixids.sh Lines 36 to 47 in 14e7184
The container user must be part of the As a side note: if you are so concerned about docker security that you require |
Very insightful. I'm running about ~50 different containers with If I am totally off-track (not being an expert), just close the issue. I just thought something could be done about this. |
I also thought about the socket proxy as I am using it for another use case, but I think the ACL isn't fine grain enough. you can either turn a permission globally on or off, which means you still can mess with non-related containers running on the same host through the proxy. it misses the ability to specify filters based on container name patterns or labels so you can allow the runner only create/stop/start job containers. |
to be fair, an act runner container is very different from a regular containerized app as it needs access to resources outside of it's container it isn't conceptually meant to access. |
Oh, it very much is. Starting other containers and all. Just checking the default drone.io docker runner it does run with I'm not sure that running |
dind-rootless also needs to be run with
The DooD container does not run dockerd, it is only included in the DinD image. I now changed the init script in a way that Maybe this works in your environment with |
Getting the error message
sudo: effective uid is not 0, is /usr/bin/sudo on a file system with the 'nosuid' option set or an NFS file system without root privileges?
on startup when I try to run the container with theno-new-privileges
option (--security-opt=no-new-privileges:true
). Using thevegardit/gitea-act-runner:latest
version obviously, since the other version usesprivileged: true
.I try to do this for all containers and maybe this is something that could be taken into account for the DooD-version?
The text was updated successfully, but these errors were encountered: