vole

Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

Say why a job's network is closed by default

0b9b10f693fcd7bd28554cf96fa592422739e3d5 · Keenan Nemetz · 6d ago · parent 629fdd87

Say why a job's network is closed by default

The runner page listed the closed defaults without saying what the network one
buys. A job with a network can reach the instance that handed it the work, the
host's other services, and the internet, and a build that fetches at run time
builds whatever the remote served rather than what the pinned image carries.

Part of #160.

docs/runner.md +15

@@ -213,6 +213,21 @@ without the network it needs. The runner advertises this with every lease, the s
	213	213	way it advertises `--label`, and the job's request is pinned with the run when it is
	214	214	queued.
	215	215
		216	A runner can be started with `--container-network bridge` and nothing breaks; that
		217	is a policy choice for a machine whose owner trusts everything it builds. What no
		218	runner can do is take the choice away from the job, and this is why. A job runs code
		219	from the repository, including a contributor branch a maintainer approved for
		220	reasons that had nothing to do with network access. With a network, that code
		221	reaches whatever the machine can reach: the instance handing out the work, since a
		222	deployed instance listens beyond loopback, the other services on that host, and
		223	anything on the internet to send out what the job can read. With no network the only
		224	things it can touch are the job tree and the container itself, both of which are
		225	discarded, so a job that declares a secret and does not need to reach anything
		226	cannot send it anywhere. No network also keeps a build honest: a job that fetches
		227	its dependencies at run time builds whatever the remote serves that day, while a
		228	closed job builds what its image carries, which is the image the run pinned by
		229	digest.
		230
	216	231	## Caching
	217	232
	218	233	A job starts with an empty container, so without help every run downloads its