bircniandsilverwind 3802feb3fe fix: enforce read-only volume restrictions (#1272) ...

Allow `valid_volumes` entries ending in `:ro` to permit only read-only mounts, so a workflow can no longer mount writable a host path the runner only shares read-only, like a certificate store. `**:ro` allows any volume read-only. An entry without `:ro` that matches too still allows writable mounts.

A named volume allowed only through `:ro` is mounted with `nocopy`, because Docker otherwise fills an empty volume from the image even when it is mounted read-only.

Fixes: https://gitea.com/gitea/runner/issues/407
Co-authored-by: silverwind <[email protected]>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1272
Reviewed-by: silverwind <[email protected]>
Co-authored-by: bircni <[email protected]>

2026-10-08 17:15:41 +00:00

..

app

fix: recognize Gitea's 401 reply for an unregistered runner (#1287)

2026-10-05 03:34:00 +00:00

pkg

fix: enforce read-only volume restrictions (#1272)

2026-10-08 17:15:41 +00:00