foster/forgejo-docs
0
0
Fork 0
mirror of https://codeberg.org/forgejo/docs.git synced 2024-11-21 17:36:59 -05:00
Code Issues Activity

admin: runner installation: recommend docker_host: "-"

Browse source 
Defaulting to docker_host: "" will expose the underlying docker socket
to all containers which is a security risk. The default must be the
most secure setup.
This commit is contained in:
Earl Warren 2024-10-29 09:11:48 +01:00
parent 58d903f1fa
commit 1f260c1254
No known key found for this signature in database
GPG key ID: 0579CB2928A78A00
1 changed files with 31 additions and 14 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

45
docs/admin/runner-installation.md
View file

@ -41,7 +41,7 @@ You should now be able to test the runner by running `forgejo-runner -v`:
``` ```
$ forgejo-runner -v $ forgejo-runner -v
forgejo-runner version v3.5.1 forgejo-runner version v4.0.0
``` ```
### Setting up the runner user ### Setting up the runner user
@ -94,7 +94,7 @@ The `Forgejo runner` relies on application containers (Docker, Podman, etc.) or
```shell ```shell
$ lxc-helpers.sh lxc_container_run forgejo-runners -- sudo --user debian bash $ lxc-helpers.sh lxc_container_run forgejo-runners -- sudo --user debian bash
$ sudo apt-get install docker.io wget gnupg2 $ sudo apt-get install docker.io wget gnupg2
$ wget -O forgejo-runner https://code.forgejo.org/forgejo/runner/releases/download/v3.4.1/forgejo-runner-amd64 $ wget -O forgejo-runner https://code.forgejo.org/forgejo/runner/releases/download/v4.0.0/forgejo-runner-amd64
... ...
``` ```
@ -133,6 +133,9 @@ displayed with `forgejo-runner generate-config`, stored in a
$ forgejo-runner generate-config > config.yml $ forgejo-runner generate-config > config.yml
# Example configuration file, it's safe to copy this as the default config file without any modification. # Example configuration file, it's safe to copy this as the default config file without any modification.
# You don't have to copy this file to your instance,
# just run `forgejo-runner generate-config > config.yaml` to generate a config file.
log: log:
# The level of logging, can be trace, debug, info, warn, error, fatal # The level of logging, can be trace, debug, info, warn, error, fatal
level: info level: info
@ -153,16 +156,24 @@ runner:
# Please note that the Forgejo instance also has a timeout (3h by default) for the job. # Please note that the Forgejo instance also has a timeout (3h by default) for the job.
# So the job could be stopped by the Forgejo instance if it's timeout is shorter than this. # So the job could be stopped by the Forgejo instance if it's timeout is shorter than this.
timeout: 3h timeout: 3h
# Whether skip verifying the TLS certificate of the Forgejo instance. # The timeout for the runner to wait for running jobs to finish when
# shutting down because a TERM or INT signal has been received. Any
# running jobs that haven't finished after this timeout will be
# cancelled.
# If unset or zero the jobs will be cancelled immediately.
shutdown_timeout: 3h
# Whether skip verifying the TLS certificate of the instance.
insecure: false insecure: false
# The timeout for fetching the job from the Forgejo instance. # The timeout for fetching the job from the Forgejo instance.
fetch_timeout: 5s fetch_timeout: 5s
# The interval for fetching the job from the Forgejo instance. # The interval for fetching the job from the Forgejo instance.
fetch_interval: 2s fetch_interval: 2s
# The interval for reporting the job status and logs to the Forgejo instance.
report_interval: 1s
# The labels of a runner are used to determine which jobs the runner can run, and how to run them. # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
# Like: ["macos-arm64:host", "ubuntu-latest:docker://node:16-bullseye", "ubuntu-22.04:docker://node:16-bullseye"] # Like: ["macos-arm64:host", "ubuntu-latest:docker://node:20-bookworm", "ubuntu-22.04:docker://node:20-bookworm"]
# If it's empty when registering, it will ask for inputting labels. # If it's empty when registering, it will ask for inputting labels.
# If it's empty when execute `daemon`, will use labels in `.runner` file. # If it's empty when executing the `daemon`, it will use labels in the `.runner` file.
labels: [] labels: []
cache: cache:
@ -178,6 +189,10 @@ cache:
# The port of the cache server. # The port of the cache server.
# 0 means to use a random available port. # 0 means to use a random available port.
port: 0 port: 0
# The external cache server URL. Valid only when enable is true.
# If it's specified, it will be used to set the ACTIONS_CACHE_URL environment variable. The URL should generally end with "/".
# Otherwise it will be set to the the URL of the internal cache server.
external_server: ""
container: container:
# Specifies the network to which the container will connect. # Specifies the network to which the container will connect.
@ -205,10 +220,12 @@ container:
# - '**' # - '**'
valid_volumes: [] valid_volumes: []
# overrides the docker client host with the specified one. # overrides the docker client host with the specified one.
# If it's empty, act_runner will find an available docker host automatically. # If "-", an available docker host will automatically be found.
# If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers. # If empty, an available docker host will automatically be found and mounted in the job container (e.g. /var/run/docker.sock).
# If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work. # Otherwise the specified docker host will be used and an error will be returned if it doesn't work.
docker_host: "" docker_host: "-"
# Pull docker image(s) even if already present
force_pull: false
host: host:
# The parent directory of a job's working directory. # The parent directory of a job's working directory.
@ -259,14 +276,14 @@ The [OCI images](https://code.forgejo.org/forgejo/-/packages/container/runner/ve
are built from the Dockerfile which is [found in the source directory](https://code.forgejo.org/forgejo/runner/src/branch/main/Dockerfile). It contains the `forgejo-runner` binary. are built from the Dockerfile which is [found in the source directory](https://code.forgejo.org/forgejo/runner/src/branch/main/Dockerfile). It contains the `forgejo-runner` binary.
```shell ```shell
$ docker run --rm code.forgejo.org/forgejo/runner:3.4.1 forgejo-runner --version $ docker run --rm code.forgejo.org/forgejo/runner:4.0.0 forgejo-runner --version
forgejo-runner version v3.4.1 forgejo-runner version v4.0.0
``` ```
It does not run as root: It does not run as root:
```shell ```shell
$ docker run --rm code.forgejo.org/forgejo/runner:3.4.1 id $ docker run --rm code.forgejo.org/forgejo/runner:4.0.0 id
uid=1000 gid=1000 groups=1000 uid=1000 gid=1000 groups=1000
``` ```
@ -303,7 +320,7 @@ services:
restart: 'unless-stopped' restart: 'unless-stopped'
gitea: gitea:
image: 'code.forgejo.org/forgejo/runner:3.4.1' image: 'code.forgejo.org/forgejo/runner:4.0.0'
links: links:
- docker-in-docker - docker-in-docker
depends_on: depends_on:
@ -356,7 +373,7 @@ To register the runner, excecute `forgejo-runner register` and fill in the promp
```shell ```shell
$ forgejo-runner register $ forgejo-runner register
INFO Registering runner, arch=arm64, os=linux, version=v3.5.1. INFO Registering runner, arch=arm64, os=linux, version=v4.0.0.
WARN Runner in user-mode. WARN Runner in user-mode.
INFO Enter the Forgejo instance URL (for example, https://next.forgejo.org/): INFO Enter the Forgejo instance URL (for example, https://next.forgejo.org/):
https://code.forgejo.org/ https://code.forgejo.org/