nprasad2077/runner
1
0 Fork 0
mirror of https://gitea.com/gitea/runner.git synced 2026-11-07 07:40:29 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix: enforce read-only volume restrictions (#1272)

Browse Source 
Allow `valid_volumes` entries ending in `:ro` to permit only read-only mounts, so a workflow can no longer mount writable a host path the runner only shares read-only, like a certificate store. `**:ro` allows any volume read-only. An entry without `:ro` that matches too still allows writable mounts.

A named volume allowed only through `:ro` is mounted with `nocopy`, because Docker otherwise fills an empty volume from the image even when it is mounted read-only.

Fixes: https://gitea.com/gitea/runner/issues/407
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1272
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>
This commit is contained in:
bircniandsilverwind authored and silverwind committed 2026-10-08 17:15:41 +00:00
1 parent 27e9b4de87
commit 3802feb3fe
3 files changed
+75 -28
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/pkg/config/config.example.yaml
+3 -1
View File
@@ -239,10 +239,12 @@ container:
#workdir_parent:
# Volumes and bind mounts containers may mount, as globs (https://github.com/bmatcuk/doublestar#patterns).
# `*` matches within a path segment, `**` across segments. Empty allows none. tmpfs mounts are always allowed.
# For example, to allow the `data` volume and all json files in `/src`:
# A `:ro` suffix allows only read-only mounts, unless an entry without it matches too.
# For example, to allow the `data` volume and all json files in `/src`, and `/etc/ssl/certs` only read-only:
# valid_volumes:
# - data
# - /src/*.json
# - /etc/ssl/certs:ro
# To allow any volume:
# valid_volumes:
# - '**'