5f717ef74b
Some checks failed
check / gate (push) Failing after 50s
I-5 says runners execute untrusted code and must be isolated by machine
boundary. act_runner needs a Docker daemon to start job containers, and the
tempting move — what every published example does — is to mount the host's
/var/run/docker.sock. That hands every workflow, including whatever a
transitive dependency's postinstall script feels like doing, the ability to
start a privileged container mounting / — root on Grant's workstation.
Instead the runner talks to its OWN dind daemon:
- runner (TRUSTED, the act_runner daemon) sits on the forge network only to
collect jobs from gitea:3000
- dind and every job container it spawns are UNTRUSTED, on a private network
with no route to the forge, its Postgres, or its .env
- jobs cannot bind-mount from the daemon host (valid_volumes: []) and are not
handed the runner's own socket (docker_host: -)
- separate compose project, cpu/memory bounded — Veron 1 is Grant's
workstation, not a dedicated build box
The gate itself now runs as a workflow, including the migration round-trip that
already caught two bugs review did not, and the I-12 check that a COMMIT_SHA
env override cannot change what /version reports.
Labels are explicit and pinned. A workflow naming a label nobody provides
queues forever and presents as a hung CI system rather than a typo — which is
what ubuntu-latest does on every windy-registry run today.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
39 lines
1.2 KiB
YAML
39 lines
1.2 KiB
YAML
# act_runner configuration (G7.1).
|
|
#
|
|
# Labels are EXPLICIT and PINNED. `ubuntu-latest` is banned (G7.5): all four
|
|
# windy-registry workflows use it and every single run fails, because a
|
|
# self-hosted runner has no such label unless you invent one. A workflow that
|
|
# names a label nobody provides queues forever and looks like a hung CI system
|
|
# rather than a typo.
|
|
|
|
log:
|
|
level: info
|
|
|
|
runner:
|
|
file: /data/.runner
|
|
capacity: 4 # concurrent jobs; Veron has 24 cores, dind is capped at 12
|
|
timeout: 30m
|
|
shutdown_timeout: 3m
|
|
insecure: false
|
|
fetch_timeout: 5s
|
|
fetch_interval: 2s
|
|
labels:
|
|
- "veron-1:docker://catthehacker/ubuntu:act-22.04"
|
|
- "linux-x64:docker://catthehacker/ubuntu:act-22.04"
|
|
|
|
cache:
|
|
enabled: true
|
|
dir: /data/cache
|
|
|
|
container:
|
|
# Job containers join the dind daemon's own bridge. NOT the forge network:
|
|
# untrusted code must never be able to reach the forge's Postgres or its
|
|
# environment (I-5).
|
|
network: bridge
|
|
privileged: false
|
|
options:
|
|
workdir_parent: /workspace
|
|
valid_volumes: [] # a job cannot bind-mount anything from the daemon host
|
|
docker_host: "-" # do NOT expose the runner's own docker socket to jobs
|
|
force_pull: false
|