nprasad2077/runner
1
0 Fork 0
mirror of https://gitea.com/gitea/runner.git synced 2026-11-15 12:23:42 +00:00
Code Issues Packages Projects Releases Wiki Activity

enhance: trust a private CA with runner.ca_file and add container.volumes (#1366)

Browse Source 
Adds `container.volumes`, mounted into every Docker job, service and action container. Sources are paths on the Docker daemon's host and need no `valid_volumes` entry, and workflow volumes may use them only with the same access.

Adds `runner.ca_file`, a private CA trusted for the Gitea instance besides the system's by the runner's connections and its artifact proxy. Runner-side git and `builtin:checkout` use it as their CA bundle for the instance, persisted with the checkout's credentials. Jobs get it at `/var/run/act/ca.crt` with `NODE_EXTRA_CA_CERTS` pointing there unless the job or its image sets it. Git in jobs, as run by `actions/checkout`, needs the CA in the image's bundle, for example through `container.volumes`.

Fixes: https://gitea.com/gitea/runner/issues/568
Fixes: https://gitea.com/gitea/runner/issues/671
Co-authored-by: silverwind <[email protected]>
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1366
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>
This commit is contained in:
bircnisilverwindsilverwind
 authored and silverwind committed 2026-11-05 05:28:40 +00:00
1 parent 7a9fccb842
commit aa56f46c89
22 files changed
+309 -75
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

internal/app/run/runner.go
+12 -8
View File
@@ -98,18 +98,20 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client)
}
envs := make(map[string]string, len(cfg.Runner.Envs))
maps.Copy(envs, cfg.Runner.Envs)
instanceTransport := client.NewTransport(cli.Address(), cfg.Runner.TLSConfig())
var cacheHandler *artifactcache.Handler
if cfg.Cache.Enabled == nil || *cfg.Cache.Enabled {
warnIgnoredCachePolicy(cfg)
warnIgnoredCacheSecret(cfg)
handler, err := artifactcache.StartHandler(artifactcache.Options{
Dir: cfg.Cache.Dir,
OutboundIP: cfg.Cache.Host,
Port: cfg.Cache.Port,
Upstream: cfg.Cache.ExternalServer,
S3: cacheS3(cfg),
Policy: CachePolicy(cfg),
Logger: logging.Default().With("module", "cache_request"),
Dir: cfg.Cache.Dir,
OutboundIP: cfg.Cache.Host,
Port: cfg.Cache.Port,
Upstream: cfg.Cache.ExternalServer,
S3: cacheS3(cfg),
Policy: CachePolicy(cfg),
Logger: logging.Default().With("module", "cache_request"),
InstanceTransport: instanceTransport,
})
if err != nil {
logging.Errorf("cannot init cache server, it will be disabled: %v", err)
@@ -140,7 +142,7 @@ func NewRunner(cfg *config.Config, reg *config.Registration, cli client.Client)
runHealthCheck: executeHealthCheck,
}
runner.isolatedCacheContainer = sync.OnceValue(runner.detectIsolatedCacheContainer)
runner.instanceTransport = client.NewTransport(cli.Address(), cfg.Runner.TLSConfig())
runner.instanceTransport = instanceTransport
return runner
}
@@ -620,10 +622,12 @@ func (r *Runner) run(ctx context.Context, task *runnerv1.Task, reporter *report.
JobCompletedHook: r.cfg.Runner.Hooks.JobCompleted,
Vars: task.Vars,
ValidVolumes: r.cfg.Container.ValidVolumes,
ContainerVolumes: r.cfg.Container.Volumes,
SharedToolCache: r.cfg.Runner.ToolCacheMode == config.ToolCacheModeShared,
InsecureSkipTLS: r.cfg.Runner.Insecure,
ClientCertFile: r.cfg.Runner.ClientCertFile,
ClientKeyFile: r.cfg.Runner.ClientKeyFile,
CAFile: r.cfg.Runner.CAFile,
InstanceTransport: r.instanceTransport,
RunnerName: r.name,
KubernetesPicker: r.kubernetesOptions,