bircniandsilverwind 3802feb3fe fix: enforce read-only volume restrictions (#1272) ...

Allow `valid_volumes` entries ending in `:ro` to permit only read-only mounts, so a workflow can no longer mount writable a host path the runner only shares read-only, like a certificate store. `**:ro` allows any volume read-only. An entry without `:ro` that matches too still allows writable mounts.

A named volume allowed only through `:ro` is mounted with `nocopy`, because Docker otherwise fills an empty volume from the image even when it is mounted read-only.

Fixes: https://gitea.com/gitea/runner/issues/407
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1272
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>

2026-10-08 17:15:41 +00:00

..

testdata

Merge gitea/act into act/

2026-04-22 22:29:06 +02:00

container_types.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00

docker_auth.go

chore: revert 4c2ab943a8 (#1148)

2026-08-06 21:50:21 +00:00

docker_build.go

chore: revert 4c2ab943a8 (#1148)

2026-08-06 21:50:21 +00:00

docker_cli_test.go

enhance: support --umask in container.options (#1238)

2026-09-22 01:20:16 +00:00

docker_cli.go

enhance: support --umask in container.options (#1238)

2026-09-22 01:20:16 +00:00

docker_create_flags_test.go

fix: keep the runner's own container.options when privileged is off (#1151)

2026-08-24 22:13:28 +00:00

docker_create_flags.go

fix: keep the runner's own container.options when privileged is off (#1151)

2026-08-24 22:13:28 +00:00

docker_images_test.go

fix: matrix-job data races + outputs, leaner offline test suite (#994)

2026-05-29 05:23:10 +00:00

docker_images.go

fix: align Docker actions, job env and host mode with GitHub (#1268)

2026-10-01 19:45:13 +00:00

DOCKER_LICENSE

Merge gitea/act into act/

2026-04-22 22:29:06 +02:00

docker_logger.go

chore: update deps, adapt lint, use json v2 (#1185)

2026-08-24 19:53:17 +00:00

docker_network_test.go

feat!: serve the actions cache from the runner (#1229)

2026-09-24 18:56:07 +00:00

docker_network.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00

docker_platform_test.go

fix(deps): bump docker deps, switch to moby/moby (#943)

2026-05-14 02:29:05 +00:00

docker_platform.go

fix(deps): bump docker deps, switch to moby/moby (#943)

2026-05-14 02:29:05 +00:00

docker_proxy_test.go

fix: docker proxy probe for podman and containerized runners (#1231)

2026-09-17 20:01:45 +00:00

docker_proxy_unix.go

enhance: bind-mount job paths through the docker proxy (#1226)

2026-09-14 20:21:58 +00:00

docker_proxy_windows.go

enhance: bind-mount job paths through the docker proxy (#1226)

2026-09-14 20:21:58 +00:00

docker_proxy.go

fix: docker proxy probe for podman and containerized runners (#1231)

2026-09-17 20:01:45 +00:00

docker_pull_test.go

fix: stop leaking per-job docker networks (#1124)

2026-07-30 16:25:47 +00:00

docker_pull.go

chore: revert 4c2ab943a8 (#1148)

2026-08-06 21:50:21 +00:00

docker_run_test.go

fix: enforce read-only volume restrictions (#1272)

2026-10-08 17:15:41 +00:00

docker_run.go

fix: enforce read-only volume restrictions (#1272)

2026-10-08 17:15:41 +00:00

docker_stub.go

fix: misc bug fixed and improvements (#1253)

2026-09-28 05:53:41 +00:00

docker_volume.go

perf: cut redundant work out of job setup and teardown (#1218)

2026-09-10 19:00:06 +00:00

executions_environment.go

Merge gitea/act into act/

2026-04-22 22:29:06 +02:00

helpers_test.go

fix: matrix-job data races + outputs, leaner offline test suite (#994)

2026-05-29 05:23:10 +00:00

host_environment_test.go

perf: speed up action downloads (#1209)

2026-09-05 08:52:10 +00:00

host_environment.go

perf: speed up action downloads (#1209)

2026-09-05 08:52:10 +00:00

kubernetes_client.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00

kubernetes_test.go

fix: extract copied directories at their destination in Kubernetes pods (#1286)

2026-10-05 11:05:17 +00:00

kubernetes.go

fix: extract copied directories at their destination in Kubernetes pods (#1286)

2026-10-05 11:05:17 +00:00

linux_container_environment_extensions_test.go

Merge gitea/act into act/

2026-04-22 22:29:06 +02:00

linux_container_environment_extensions.go

fix: allow relocating the tool cache and mounting over runner paths (#1122)

2026-07-29 21:32:28 +00:00

parse_env_file_test.go

fix: improve behaviour across masking, commands and status (#1194)

2026-08-27 09:36:27 +00:00

parse_env_file.go

fix: improve behaviour across masking, commands and status (#1194)

2026-08-27 09:36:27 +00:00

tar.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00