vole
Clone
Read only, no credentials:
https://rodent.software/git/vole.git
Write over SSH with a registered key:
git clone ssh://git@0.0.0.0:2222/vole.git
A free and open-source forge that lives in your Git repo.
Bound the runner's containers and keep its disk free
4e3759da08a603ede50107e89a23ff6d5432b7ac · Keenan Nemetz · 2h ago · parent c4ad0d5a
Bound the runner's containers and keep its disk free The container boundary was good and the resource the job consumes was not. A job could fork without a bound, write /tmp until the machine's RAM was gone, and fill the disk its workspace sits on — and the runner would only notice when a build died. The isolation protects the forge's data; this protects the machine that runs the code. - `--container-pids` now defaults to 2048 and zero means the default, not "no limit": a bound nobody set is the easiest one to be missing, and a job that can fork without one is a fork bomb away from taking the machine. - `--container-tmpfs` is new and defaults to 1G. /tmp is a tmpfs, so its size is memory, and an unsized one is a build that fills RAM without writing a byte to the workspace. It is passed to service containers too. - `--container-memory` stays the operator's setting rather than a default, because the right number is the machine's size and a wrong default would show up as an OOM kill in someone's build. All three places a runner is configured now set it: the packaged runner.env example, the manual steps in the deploy guide, and the cloud-init template (RUNNER_MEMORY, default 4G, alongside RUNNER_PIDS, RUNNER_TMPFS and RUNNER_DISK_RESERVE). - `--disk-reserve` (default 2G) is how the job tree is bounded. It is a host bind mount, so the runtime cannot quota it and a filesystem quota needs root; a walker over the tree would cost more than it protects. What the runner can promise is that it notices: one statfs per second while a command runs, and the job is stopped below the reserve with the numbers in its log. `--dir` on its own sized filesystem is the hard bound, and the docs say so. - The runner unit gets `MemoryMax=90%` as the backstop under all of it, for a job that gets past its own cgroup. It is a percentage so the unit does not have to know the machine. TasksMax is deliberately not set: the container's own --container-pids already applies, and a unit value would have to track --jobs and --container-pids and would fail builds, looking like the workflow's fault, when they drifted apart. A workflow still cannot raise or remove any of this: the limits are flags on the runner and the unit, never fields a job can set. scripts/check-deploy.py now fails when the rendered runner arguments stop carrying the memory, pids, tmpfs or disk limits, so the first-boot file cannot quietly lose them. Closes 01M6S798BH0BK00R2B5N1KDJYM
ci/agent/disk.go +37
| @@ -0,0 +1,37 @@ | |||
| 1 | package agent | ||
| 2 | |||
| 3 | // The runner's disk, as the only bound a job tree has. | ||
| 4 | // | ||
| 5 | // A job's workspace is a bind mount from the host: the runtime cannot quota it, and a | ||
| 6 | // filesystem quota there would need root and a filesystem that supports one. What the | ||
| 7 | // runner can promise is that it notices, so a job that writes without a bound costs | ||
| 8 | // that job instead of the machine. The reserve is one statfs on the filesystem holding | ||
| 9 | // --dir, checked while a command runs, and reported with the numbers. | ||
| 10 | |||
| 11 | import ( | ||
| 12 | "syscall" | ||
| 13 | ) | ||
| 14 | |||
| 15 | // freeBytes reports how many bytes are available to this user on the filesystem | ||
| 16 | // holding dir. | ||
| 17 | func freeBytes(dir string) (int64, error) { | ||
| 18 | var st syscall.Statfs_t | ||
| 19 | if err := syscall.Statfs(dir, &st); err != nil { | ||
| 20 | return 0, err | ||
| 21 | } | ||
| 22 | return int64(st.Bavail) * int64(st.Bsize), nil | ||
| 23 | } | ||
| 24 | |||
| 25 | // diskLow reports whether the filesystem holding dir has less than reserve bytes | ||
| 26 | // free. A reserve of zero disables the check, which is what a runner whose --dir is | ||
| 27 | // on its own sized filesystem may choose. | ||
| 28 | func diskLow(dir string, reserve int64) (free int64, low bool, err error) { | ||
| 29 | if reserve <= 0 || dir == "" { | ||
| 30 | return 0, false, nil | ||
| 31 | } | ||
| 32 | free, err = freeBytes(dir) | ||
| 33 | if err != nil { | ||
| 34 | return 0, false, err | ||
| 35 | } | ||
| 36 | return free, free < reserve, nil | ||
| 37 | } | ||