Bump to version 2.273.0

Notes regarding PAT scopes and privileges.

.github/FUNDING.yml

@@ -0,0 +1,3 @@
+# These are supported funding model platforms
+
+github: myoung34

.github/workflows/base.yml

@@ -0,0 +1,71 @@
+name: GitHub Actions Runner in Docker - Base
+on:
+  push:
+    paths:
+      - Dockerfile.base
+    branches:
+      - master
+      - develop
+  schedule:
+    - cron:  '0 22 * * *'
+
+
+jobs:
+  ubuntu_base_latest_deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Copy Repo Files
+      uses: actions/checkout@master
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: crazy-max/ghaction-docker-buildx@v1
+      with:
+        buildx-version: latest
+    - name: Available platforms
+      run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Login
+      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
+    - name: Build
+      run: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+  ubuntu_base_bionic_deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Copy Repo Files
+      uses: actions/checkout@master
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: crazy-max/ghaction-docker-buildx@v1
+      with:
+        buildx-version: latest
+    - name: Available platforms
+      run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Copy Dockerfile
+      run: cp Dockerfile.base Dockerfile.base.ubuntu-bionic; sed -i.bak 's/FROM.*/FROM ubuntu:bionic/' Dockerfile.base.ubuntu-bionic
+    - name: Login
+      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
+    - name: Build
+      run: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+  ubuntu_base_xenial_deploy:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Copy Repo Files
+      uses: actions/checkout@master
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+    - name: Set up Docker Buildx
+      id: buildx
+      uses: crazy-max/ghaction-docker-buildx@v1
+      with:
+        buildx-version: latest
+    - name: Available platforms
+      run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Copy Dockerfile
+      run: cp Dockerfile.base Dockerfile.base.ubuntu-xenial; sed -i.bak 's/FROM.*/FROM ubuntu:xenial/' Dockerfile.base.ubuntu-xenial
+    - name: Login
+      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
+    - name: Build
+      run: docker buildx build -f Dockerfile.base.ubuntu-xenial -t ${ORG}/github-runner-base:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .

.github/workflows/deploy.yml

@@ -1,9 +1,14 @@
-name: Publish Docker
+name: GitHub Actions Runner in Docker - Latest
 on:
   push:
-    branches:    
+    paths-ignore:
+      - Dockerfile.base
+      - README.md
+    branches:
       - master
       - develop
+  schedule:
+    - cron:  '59 23 * * *'
 
 jobs:
   ubuntu_latest_deploy:
@@ -11,46 +16,56 @@ jobs:
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
       with:
-        version: latest
+        buildx-version: latest
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu -t myoung34/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
   ubuntu_bionic_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
       with:
-        version: latest
+        buildx-version: latest
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Copy Dockerfile
+      run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t myoung34/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
   ubuntu_xenial_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
       with:
-        version: latest
+        buildx-version: latest
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Copy Dockerfile
+      run: cp Dockerfile Dockerfile.ubuntu-xenial; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-xenial/" Dockerfile.ubuntu-xenial
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t myoung34/github-runner:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .

.github/workflows/release.yml

@@ -1,61 +1,90 @@
-name: Publish Docker
+name: GitHub Actions Runner in Docker - Release
 on:
   push:
     tags:
       - '*'
 
 jobs:
-  ubuntu_tag_deploy:
+  create-release:
+    name: Create Release
     runs-on: ubuntu-latest
     steps:
+    - name: Checkout code
+      uses: actions/checkout@v2
+    - name: Create Release
+      id: create_release
+      uses: actions/create-release@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        tag_name: ${{ github.ref }}
+        release_name: Release ${{ github.ref }}
+        draft: false
+        prerelease: false
+  ubuntu_latest_tag:
+    runs-on: ubuntu-latest
+    needs: create-release
+    steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo "::set-env name=TAG::$(echo ${GITHUB_REF} | sed -e "s/refs\/tags\///g")"
+      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
       with:
-        version: latest
+        buildx-version: latest
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu -t myoung34/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_bionic_deploy:
+      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+  ubuntu_bionic_tag:
     runs-on: ubuntu-latest
+    needs: create-release
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo "::set-env name=TAG::$(echo ${GITHUB_REF} | sed -e "s/refs\/tags\///g")"
+      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
       with:
-        version: latest
+        buildx-version: latest
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Copy Dockerfile
+      run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t myoung34/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_xenial_deploy:
+      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+  ubuntu_xenial_tag:
     runs-on: ubuntu-latest
+    needs: create-release
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo "::set-env name=TAG::$(echo ${GITHUB_REF} | sed -e "s/refs\/tags\///g")"
+      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+    - name: Get GitHub organization or user
+      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
       with:
-        version: latest
+        buildx-version: latest
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
+    - name: Copy Dockerfile
+      run: cp Dockerfile Dockerfile.ubuntu-xenial; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-xenial/" Dockerfile.ubuntu-xenial
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t myoung34/github-runner:${TAG}-ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:${TAG}-ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .

.gitignore

@@ -0,0 +1 @@
+*.bak

Dockerfile

@@ -0,0 +1,22 @@
+# hadolint ignore=DL3007
+FROM myoung34/github-runner-base:latest
+LABEL maintainer="myoung34@my.apsu.edu"
+
+ARG GH_RUNNER_VERSION="2.273.0"
+ARG TARGETPLATFORM
+
+SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+
+WORKDIR /actions-runner
+COPY install_actions.sh /actions-runner
+
+RUN chmod +x /actions-runner/install_actions.sh \
+  && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
+  && rm /actions-runner/install_actions.sh
+
+COPY token.sh /
+RUN chmod +x /token.sh
+
+COPY entrypoint.sh /
+RUN chmod +x /entrypoint.sh
+ENTRYPOINT ["/entrypoint.sh"]

Dockerfile.base

@@ -1,15 +1,17 @@
-FROM ubuntu:rolling
-LABEL maintainer="3vilpenguin@gmail.com"
+FROM ubuntu:eoan
+LABEL maintainer="myoung34@my.apsu.edu"
 
-ARG GIT_VERSION="2.23.0"
-ENV DEBIAN_FRONTEND=noninteractive
+ARG GIT_VERSION="2.26.2"
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
+ENV DEBIAN_FRONTEND=noninteractive
 # hadolint ignore=DL3003
 RUN apt-get update && \
   apt-get install -y --no-install-recommends \
+    awscli \
     curl \
     tar \
+    unzip \
     apt-transport-https \
     ca-certificates \
     sudo \
@@ -18,12 +20,10 @@ RUN apt-get update && \
     build-essential \
     zlib1g-dev \
     gettext \
-    liblttng-ust-ctl4 \
     liblttng-ust0 \
-    liburcu6 \
     libcurl4-openssl-dev \
     inetutils-ping \
-  && rm -rf /var/lib/apt/lists/* \
+    jq \
   && c_rehash \
   && cd /tmp \
   && curl -sL https://www.kernel.org/pub/software/scm/git/git-${GIT_VERSION}.tar.gz -o git.tgz \
@@ -33,24 +33,11 @@ RUN apt-get update && \
   && make \
   && make install \
   && cd / \
-  && rm -rf /tmp/git.tgz /tmp/git-${GIT_VERSION}
-
-RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-  && [[ $(lsb_release -cs) == "eoan" ]] && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu disco stable" ) || ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" )\
+  && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
+  && [[ $(lsb_release -cs) == "eoan" ]] && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu disco stable" ) || ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" ) \
   && apt-get update \
-  && apt-get install -y docker-ce --no-install-recommends \
-  && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /actions-runner
-COPY install_actions.sh /actions-runner
-
-# Put version here to prevent cache invalidation
-ENV GH_RUNNER_VERSION="2.164.0"
-RUN chmod +x /actions-runner/install_actions.sh \
-  && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} \
-  && rm /actions-runner/install_actions.sh
-
-WORKDIR /_work
-COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]
+  && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends \
+  && curl -sL "https://github.com/docker/compose/releases/download/1.25.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose \
+  && chmod +x /usr/local/bin/docker-compose \
+  && rm -rf /var/lib/apt/lists/* \
+  && rm -rf /tmp/*

Dockerfile.ubuntu-bionic

@@ -1,36 +0,0 @@
-FROM ubuntu:bionic
-LABEL maintainer="3vilpenguin@gmail.com"
-
-ARG GH_RUNNER_VERSION="2.163.1"
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN apt-get update && \
-  apt-get install -y --no-install-recommends \
-    curl \
-    tar \
-    git \
-    apt-transport-https \
-    ca-certificates \
-    sudo \
-    gnupg-agent \
-    software-properties-common \
-    inetutils-ping \
-  && rm -rf /var/lib/apt/lists/*
-
-RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-  && add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
-  && apt-get update \
-  && apt-get install -y docker-ce --no-install-recommends \
-  && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /actions-runner
-RUN curl -O https://githubassets.azureedge.net/runners/${GH_RUNNER_VERSION}/actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz \
-  && tar -zxf actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz \
-  && rm -f actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz \
-  && ./bin/installdependencies.sh \
-  && mkdir /_work
-
-WORKDIR /_work
-COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]

Dockerfile.ubuntu-xenial

@@ -1,36 +0,0 @@
-FROM ubuntu:xenial
-LABEL maintainer="3vilpenguin@gmail.com"
-
-ARG GH_RUNNER_VERSION="2.163.1"
-
-SHELL ["/bin/bash", "-o", "pipefail", "-c"]
-RUN apt-get update && \
-  apt-get install -y --no-install-recommends \
-    curl \
-    tar \
-    git \
-    apt-transport-https \
-    ca-certificates \
-    sudo \
-    gnupg-agent \
-    software-properties-common \
-    inetutils-ping \
-  && rm -rf /var/lib/apt/lists/*
-
-RUN curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-  && add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" \
-  && apt-get update \
-  && apt-get install -y docker-ce --no-install-recommends \
-  && rm -rf /var/lib/apt/lists/*
-
-WORKDIR /actions-runner
-RUN curl -O https://githubassets.azureedge.net/runners/${GH_RUNNER_VERSION}/actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz \
-  && tar -zxf actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz \
-  && rm -f actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz \
-  && ./bin/installdependencies.sh \
-  && mkdir /_work
-
-WORKDIR /_work
-COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
-ENTRYPOINT ["/entrypoint.sh"]

LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2020 Marcus Young
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

README.md

@@ -1,40 +1,116 @@
 Docker Github Actions Runner
 ============================
 
-This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners) with docker-in-docker
+[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner)
 
-This has been tested and verified on:
+This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).
 
- * x86_64
- * armhf
- * armv7
- * arm64
+## Docker Artifacts ##
+
+| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description |
+| --- | --- | --- | --- | --- |
+| ubuntu eoan | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. |
+| ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | 
+| ubuntu xenial | `x86_64`,`armv7`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). |
+
+These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
+
+## Environment Variables ##
+
+| Environment Variable | Description |
+| --- | --- |
+| `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
+| `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
+| `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
+| `ORG_RUNNER` | Only valid if using `ACCESS_TOKEN`. This will set the runner to an org runner. Default is 'false'. Valid values are 'true' or 'false'. If this is set to true you must also set `ORG_NAME` and makes `REPO_URL` unneccesary |
+| `ORG_NAME` | The organization name for the runner to register under. Requires `ORG_RUNNER` to be 'true'. No default value. |
+| `LABELS` | A comma separated string to indicate the labels. Default is 'default' |
+| `REPO_URL` | If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo' |
+| `RUNNER_TOKEN` | If not using a PAT for `ACCESS_TOKEN` this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. `ACCESS_TOKEN` is likely preferred. |
+| `RUNNER_WORKDIR` | The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files. |
 
 ## Examples ##
 
-Manual:
+### Note ###
+
+If you're using a RHEL based OS with SELinux, add `--security-opt=label=disable` to prevent [permission denied](https://github.com/myoung34/docker-github-actions-runner/issues/9)
+
+### Manual ###
 
 ```
-docker run -it \
-  -e REPO_URL="https://github.com/myoung34/LEDSpicer" \
+# org runner 
+docker run -d --restart always --name github-runner \
+  -e RUNNER_NAME_PREFIX="myrunner" \
+  -e ACCESS_TOKEN="footoken" \
+  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e ORG_RUNNER="true" \
+  -e ORG_NAME="octokode" \
+  -e LABELS="my-label,other-label" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
+  myoung34/github-runner:latest
+# per repo
+docker run -d --restart always --name github-runner \
+  -e REPO_URL="https://github.com/myoung34/repo" \
+  -e RUNNER_NAME="foo-runner" \
   -e RUNNER_TOKEN="footoken" \
+  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
   myoung34/github-runner:latest
 ```
 
-Or as an alias:
+Or shell wrapper:
 
 ```
-function run-server {
-    name=github-actions-$(echo $1 | sed 's/\//-/g')
+function github-runner {
+    name=github-runner-${1//\//-}
+    org=$(dirname $1)
+    repo=$(basename $1)
+    tag=${3:-latest}
     docker rm -f $name
-    docker run -d --restart=always -e REPO_URL="https://github.com/$1" -e RUNNER_TOKEN="$2" -v /var/run/docker.sock:/var/run/docker.sock --name $name github-runner:latest
+    docker run -d --restart=always \
+        -e REPO_URL="https://github.com/${org}/${repo}" \
+        -e RUNNER_TOKEN="$2" \
+        -e RUNNER_NAME="linux-${repo}" \
+        -e RUNNER_WORKDIR="/tmp/github-runner-${repo}" \
+        -e LABELS="my-label,other-label" \
+        -v /var/run/docker.sock:/var/run/docker.sock \
+        -v /tmp/github-runner-${repo}:/tmp/github-runner-${repo} \
+        --name $name ${org}/github-runner:${tag}
 }
 
-run-server your-account/your-repo        AARGHTHISISYOURGHACTIONSTOKEN
-run-server your-account/some-other-repo  ARGHANOTHERGITHUBACTIONSTOKEN
+github-runner your-account/your-repo       AARGHTHISISYOURGHACTIONSTOKEN
+github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-xenial
 ```
 
-Nomad:
+Or `docker-compose.yml`:
+```yml
+version: '2.3'
+
+services:
+  worker:
+    build: .
+    image: myoung34/github-runner:latest
+    environment:
+      REPO_URL: https://github.com/example/repo
+      RUNNER_NAME: example-name
+      RUNNER_TOKEN: someGithubTokenHere
+      RUNNER_WORKDIR: /tmp/runner/work
+      ORG_RUNNER: 'false'
+      LABELS: linux,x64,gpu
+    security_opt:
+      # needed on SELinux systems to allow docker container to manage other docker containers
+      - label:disable
+    volumes:
+      - '/var/run/docker.sock:/var/run/docker.sock'
+      - '/tmp/runner:/tmp/runner'
+      # note: a quirk of docker-in-docker is that this path 
+      # needs to be the same path on host and inside the container,
+      # docker mgmt cmds run outside of docker but expect the paths from within
+```
+
+### Nomad ###
 
 ```
 job "github_runner" {
@@ -45,22 +121,81 @@ job "github_runner" {
     driver = "docker"
 
     env {
-      REPO_URL = "https://github.com/myoung34/LEDSpicer"
-      RUNNER_TOKEN = "footoken"
+      ACCESS_TOKEN       = "footoken"
+      RUNNER_NAME_PREFIX = "myrunner" \
+      RUNNER_WORKDIR     = "/tmp/github-runner-your-repo"
+      ORG_RUNNER         = "true"
+      ORG_NAME           = "octokode"
+      LABELS             = "my-label,other-label"
     }
 
     config {
       privileged = true
       image = "myoung34/github-runner:latest"
       volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock"
+        "/var/run/docker.sock:/var/run/docker.sock",
+        "/tmp/github-runner-your-repo:/tmp/github-runner-your-repo",
       ]
     }
   }
 }
 ```
 
-## Usage ##
+### Kubernetes ###
+
+```
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: actions-runner
+  namespace: runners
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: actions-runner
+  template:
+    metadata:
+      labels:
+        app: actions-runner
+    spec:
+      volumes:
+      - name: dockersock
+        hostPath:
+          path: /var/run/docker.sock
+      - name: workdir
+        hostPath:
+          path: /tmp/github-runner-your-repo
+      containers:
+      - name: runner
+        image: myoung34/github-runner:latest
+        env:
+        - name: ORG_RUNNER
+          value: true
+        - name: ORG_NAME
+          value: octokode
+        - name: LABELS
+          value: my-label,other-label
+        - name: RUNNER_TOKEN
+          value: footoken
+        - name: REPO_URL
+          value: https://github.com/your-account/your-repo
+        - name: RUNNER_NAME_PREFIX
+          value: foo
+        - name: RUNNER_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: RUNNER_WORKDIR
+          value: /tmp/github-runner-your-repo
+        volumeMounts:
+        - name: dockersock
+          mountPath: /var/run/docker.sock
+        - name: workdir
+          mountPath: /tmp/github-runner-your-repo
+```
+
+## Usage From GH Actions Workflow ##
 
 ```
 name: Package
@@ -77,3 +212,34 @@ jobs:
     - name: build packages
       run: make all
 ```
+
+## Automatically Acquiring a Runner Token  ##
+
+A runner token can be automatically acquired at runtime if `ACCESS_TOKEN` (a GitHub personal access token) is a supplied. This uses the [GitHub Actions API](https://developer.github.com/v3/actions/self_hosted_runners/#create-a-registration-token). e.g.:
+
+```
+docker run -d --restart always --name github-runner \
+  -e ACCESS_TOKEN="footoken" \
+  -e RUNNER_NAME="foo-runner" \
+  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e ORG_RUNNER="true" \
+  -e ORG_NAME="octokode" \
+  -e LABELS="my-label,other-label" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
+  myoung34/github-runner:latest
+```
+
+## Create GitHub personal access token  ##
+
+Creating GitHub personal access token (PAT) for using by self-hosted runner make sure the following scopes are selected:
+
+* repo (all)
+* admin:org (all) **_(mandatory for organization-wide runner)_**
+* admin:public_key - read:public_key
+* admin:repo_hook - read:repo_hook
+* admin:org_hook
+* notifications
+* workflow
+ 
+Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.

SECURITY.md

@@ -0,0 +1,23 @@
+## Security
+
+If you believe you have found a security vulnerability, please report it to me as described below.
+
+## Reporting Security Issues
+
+**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).  
+
+If you'd like to communicate securely, my keybase is [here](https://keybase.io/3vilpenguin)
+
+Please include the requested information listed below (as much as you can provide) to help better understand the nature and scope of the possible issue:
+
+  * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+  * Full paths of source file(s) related to the manifestation of the issue
+  * The location of the affected source code (tag/branch/commit or direct URL)
+  * Any special configuration required to reproduce the issue
+  * Step-by-step instructions to reproduce the issue
+  * Proof-of-concept or exploit code (if possible)
+  * Impact of the issue, including how an attacker might exploit the issue
+
+## Preferred Languages
+
+I prefer all communications to be in English.

entrypoint.sh

@@ -1,7 +1,38 @@
 #!/bin/bash
+
 export RUNNER_ALLOW_RUNASROOT=1
 export PATH=$PATH:/actions-runner
-_RUNNER_NAME=${RUNNER_NAME:-default}
+
+deregister_runner() {
+  echo "Caught SIGTERM. Deregistering runner"
+  _TOKEN=$(bash /token.sh)
+  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  ./config.sh remove --token "${RUNNER_TOKEN}"
+  exit
+}
+
+_RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo '')}
 _RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
-config.sh --url "${REPO_URL}" --token "${RUNNER_TOKEN}" --name "${_RUNNER_NAME}" --work "${_RUNNER_WORKDIR}"
-exec run.sh
+_LABELS=${LABELS:-default}
+_SHORT_URL=${REPO_URL}
+
+if [[ -n "${ACCESS_TOKEN}" ]]; then
+  _TOKEN=$(bash /token.sh)
+  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  _SHORT_URL=$(echo "${_TOKEN}" | jq -r .short_url)
+fi
+
+echo "Configuring"
+./config.sh \
+    --url "${_SHORT_URL}" \
+    --token "${RUNNER_TOKEN}" \
+    --name "${_RUNNER_NAME}" \
+    --work "${_RUNNER_WORKDIR}" \
+    --labels "${_LABELS}" \
+    --unattended \
+    --replace
+
+unset RUNNER_TOKEN
+trap deregister_runner SIGINT SIGQUIT SIGTERM
+
+./bin/runsvc.sh

install_actions.sh

@@ -1,13 +1,14 @@
 #!/bin/bash -x
 GH_RUNNER_VERSION=$1
+TARGETPLATFORM=$2
 
-export ACTIONS_ARCH="x64"
-if [[ $(dpkg --print-architecture) == "armhf" ]]; then
-  export ACTIONS_ARCH="arm"
-elif [[ $(dpkg --print-architecture) == "arm64" ]]; then
-  export ACTIONS_ARCH="arm64"
+export TARGET_ARCH="x64"
+if [[ $TARGETPLATFORM == "linux/arm/v7" ]]; then
+  export TARGET_ARCH="arm"
+elif [[ $TARGETPLATFORM == "linux/arm64" ]]; then
+  export TARGET_ARCH="arm64"
 fi
-curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/actions-runner-linux-x64-${GH_RUNNER_VERSION}.tar.gz" > actions.tar.gz
+curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/actions-runner-linux-${TARGET_ARCH}-${GH_RUNNER_VERSION}.tar.gz" > actions.tar.gz
 tar -zxf actions.tar.gz
 rm -f actions.tar.gz
 ./bin/installdependencies.sh

token.sh

@@ -0,0 +1,33 @@
+#!/bin/bash
+
+_ORG_RUNNER=${ORG_RUNNER:-false}
+
+URI=https://api.github.com
+API_VERSION=v3
+API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
+AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
+
+REPO_URL=${REPO_URL:-${URI}}
+_PROTO="$(echo "${REPO_URL}" | grep :// | sed -e's,^\(.*://\).*,\1,g')"
+# shellcheck disable=SC2116
+_URL="$(echo "${REPO_URL/${_PROTO}/}")"
+_PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
+_ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
+_REPO="$(echo "${_PATH}" | cut -d/ -f2)"
+
+_FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
+if [[ ${_ORG_RUNNER} == "true" ]]; then
+  [[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
+  _FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
+  _SHORT_URL="${_PROTO}github.com/${ORG_NAME}"
+else
+  _SHORT_URL=$REPO_URL
+fi
+
+RUNNER_TOKEN="$(curl -XPOST -fsSL \
+  -H "${AUTH_HEADER}" \
+  -H "${API_HEADER}" \
+  "${_FULL_URL}" \
+| jq -r '.token')"
+
+echo "{\"token\": \"${RUNNER_TOKEN}\", \"short_url\": \"${_SHORT_URL}\", \"full_url\": \"${_FULL_URL}\"}"