mirror of
https://gitea.com/gitea/act_runner
synced 2026-09-21 19:37:07 +02:00
silverwind
699a97fc8c
Containers a job starts through its Docker socket, for example `docker run -v "$PWD:/src"`, `./data:/data` in docker compose, or actions like dockerfile-roast, can now bind-mount the workspace and other paths the job sees, as on a host, without `bind_workdir`. The per-job Docker proxy rewrites container and volume create requests. A bind source, or the device of a `local` volume with `o: bind`, that lies under one of the job container's mounts is pointed at that mount's path on the daemon, read from inspecting the job container. Paths that already name a daemon path, like `GITEA_DOCKER_WORKSPACE`, and paths outside the job's mounts pass through unchanged. The proxy now also starts when the runner runs in a container given the host's Docker socket, by placing its socket in the runner's working directory, and in rootless dind, by granting the daemon socket's group through an ACL. Fixes https://gitea.com/gitea/runner/issues/1219 Fixes https://gitea.com/gitea/runner/issues/1193 Reviewed-on: https://gitea.com/gitea/runner/pulls/1226 Reviewed-by: bircni <bircni@icloud.com> Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com>
57 lines
2.8 KiB
YAML
57 lines
2.8 KiB
YAML
name: docker-proxy
|
|
on: push
|
|
jobs:
|
|
proxy:
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- uses: actions/checkout@v4
|
|
- uses: ./action
|
|
- if: env.PROXY_TEST_MODE == 'proxy'
|
|
run: |
|
|
docker run -d --restart always --network "$PROXY_TEST_RESOURCE" --name "$PROXY_TEST_RESOURCE-detached" "$PROXY_TEST_IMAGE" sleep infinity
|
|
echo "{services: {app: {image: $PROXY_TEST_IMAGE, command: sleep infinity, volumes: [named:/named]}}, volumes: {named: {}}}" | docker compose -f - up -d
|
|
binds:
|
|
needs: proxy
|
|
runs-on: ubuntu-latest
|
|
steps:
|
|
- run: |
|
|
test -z "$(docker ps -aq -f name="$PROXY_TEST_RESOURCE-detached" -f name="$PROXY_TEST_RESOURCE-app"; docker volume ls -q -f name="${PROXY_TEST_RESOURCE}_named"; docker network ls -q -f name="${PROXY_TEST_RESOURCE}_default")"
|
|
mkdir data && echo from-job > data/marker
|
|
- id: run
|
|
run: |
|
|
docker run --rm -v "${{ github.workspace }}:/src:ro" -v "$PWD:$PWD" -v ./data/created:/created -v "$GITHUB_OUTPUT:/output" \
|
|
--mount "type=bind,src=$PWD/data/../data,dst=/spelled,readonly" \
|
|
--mount "type=volume,dst=/device,volume-opt=type=none,volume-opt=o=bind,volume-opt=device=$PWD/data" \
|
|
"$PROXY_TEST_IMAGE" sh -c 'cat /src/data/marker "$0/data/marker" /spelled/marker /device/marker | grep -c from-job | grep -qx 4 && echo from-nested > /created/file && echo value=from-nested >> /output' "$PWD"
|
|
grep -qx from-nested data/created/file
|
|
- run: |
|
|
test "${{ steps.run.outputs.value }}" = from-nested
|
|
cat > compose.yaml <<'EOF'
|
|
services:
|
|
app:
|
|
image: ${PROXY_TEST_IMAGE}
|
|
command: cat /short/marker /long/marker /named/marker
|
|
volumes:
|
|
- ./data:/short
|
|
- type: bind
|
|
source: ./data
|
|
target: /long
|
|
bind:
|
|
create_host_path: false
|
|
- named:/named
|
|
volumes:
|
|
named:
|
|
driver: local
|
|
driver_opts:
|
|
type: none
|
|
o: bind
|
|
device: ./data
|
|
EOF
|
|
test "$(docker compose run --rm app | grep -c from-job)" = 3
|
|
docker compose down --volumes
|
|
- run: |
|
|
docker run --rm --user 1001 --group-add 2375 -v /var/run/docker.sock:/var/run/docker.sock -v /usr/local/bin/docker:/usr/local/bin/docker:ro -v "${GITEA_DOCKER_WORKSPACE:?}/data:/data:ro" \
|
|
"$PROXY_TEST_IMAGE" sh -c 'grep -qx from-job /data/marker && docker volume create "$0"' "$PROXY_TEST_RESOURCE-nested"
|
|
test "$(docker volume inspect -f '{{ index .Labels "com.gitea.runner.job" }}' "$PROXY_TEST_RESOURCE-nested")" = "$JOB_CONTAINER_NAME"
|
|
echo "docker binds verified"
|