Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

#255

Make the packaged runner able to create a container on Debian and Ubuntu

merged · by keenan 4h ago · merged into main at 9704d735 by keenan 4h ago

keenan opened this 4h ago

Closes #237, #239, and #241 as one change: they are the three failures in a row between a machine built exactly as docs/deploy/runner.md says and a finished job, and each is a setting the distributions get wrong or leave out.

What changed

  • packaging/systemd/vole-runner.service: NoNewPrivileges=false, with the reason beside the existing sandboxing note. Setuid newuidmap/newgidmap is how rootless podman, Docker, and nerdctl map the caller into a container, and NoNewPrivileges=true stops a setuid helper from gaining privilege. The rest of the hardening stays, including LimitCORE=0.
  • packaging/containers/registries.conf → /etc/containers/registries.conf.d/50-vole-runner.conf: unqualified-search-registries = ["docker.io"].
  • packaging/containers/containers.conf → /etc/containers/containers.conf.d/50-vole-runner.conf: [engine] cgroup_manager = "cgroupfs".
  • Both are conffiles, numbered 50 so a site overrides with 99-site.conf.
  • docs/deploy/runner.md: a section naming both files, the failure each one prevents, and the user-unit-with-enable-linger alternative including the /run/user/<uid> conflict with XDG_RUNTIME_DIR=/run/vole-runner.
  • docs/packaging.md: both files in the install table.
  • scripts/check-deploy.py: fails when the package stops installing either drop-in, when a drop-in loses its setting, or when the unit goes back to defeating the uid mapping.

Decisions worth a look

  • #239 went the runner’s way, not the repository’s. Qualifying the repository’s own .vole/images would not help a contributor who adds a workflow later, which is the population more likely to hit it.
  • A drop-in rather than CONTAINERS_CONF (which replaces instead of merging) or CONTAINERS_CONF_OVERRIDE (newer than podman 4.9 in Ubuntu 24.04). Drop-in directories are old enough to be in Debian, Ubuntu, and Fedora today.
  • Cloud-init is unchanged. It installs the package, so the package is the one place the settings live and a second copy cannot drift.

Testing

vole workflow run verify passes (format, vet, build, licenses, govulncheck, packages, deployment files, links, tests). The deb built in the packages step carries both files as conffiles at mode 0644, and the rpm builds.

What I could not check here: this machine has Docker (29.8.1) and no podman, so the two drop-ins are not exercised against a live rootless podman. The behaviour they name is the one recorded in the three issues from the machine where each was hit. A reviewer with a Debian or Ubuntu box can confirm by installing the built deb and running one job whose image names a digest-pinned short-name base.

Discussion (0)

No discussion yet.