[Automated 🤖 ] Bump to version 2.278.0

Add access token at env kube

.github/workflows/base.yml

@@ -6,6 +6,9 @@ on:
     branches:
       - master
       - develop
+  schedule:
+    - cron:  '0 22 * * *'
+
 
 jobs:
   ubuntu_base_latest_deploy:
@@ -14,7 +17,7 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -25,14 +28,19 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
   ubuntu_base_bionic_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -45,14 +53,19 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
   ubuntu_base_xenial_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -65,4 +78,9 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-xenial -t ${ORG}/github-runner-base:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.base.ubuntu-xenial -t ${ORG}/github-runner-base:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm64 .

.github/workflows/deploy.yml

@@ -7,6 +7,8 @@ on:
     branches:
       - master
       - develop
+  schedule:
+    - cron:  '59 23 * * *'
 
 jobs:
   ubuntu_latest_deploy:
@@ -15,7 +17,7 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -26,14 +28,19 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
   ubuntu_bionic_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -46,14 +53,19 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
   ubuntu_xenial_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -66,4 +78,9 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm64 .

.github/workflows/release.yml

@@ -28,9 +28,9 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -41,7 +41,12 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
   ubuntu_bionic_tag:
     runs-on: ubuntu-latest
     needs: create-release
@@ -49,9 +54,9 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -64,7 +69,12 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
   ubuntu_xenial_tag:
     runs-on: ubuntu-latest
     needs: create-release
@@ -72,9 +82,9 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -87,4 +97,9 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:${TAG}-ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:${TAG}-ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm64 .

.pre-commit-config.yaml

@@ -3,6 +3,7 @@ repos:
   rev: 1.0.2
   hooks:
   - id: shell-lint
+    args: [-e, SC1008]
 - repo: https://github.com/stratasan/hadolint-pre-commit
   rev: cdefcb096e520a6daa9552b1d4636f5f1e1729cd
   hooks:

.tool-versions

@@ -0,0 +1 @@
+shellcheck 0.7.0

Dockerfile

@@ -2,7 +2,10 @@
 FROM myoung34/github-runner-base:latest
 LABEL maintainer="myoung34@my.apsu.edu"
 
-ARG GH_RUNNER_VERSION="2.267.1"
+ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
+RUN mkdir -p /opt/hostedtoolcache
+
+ARG GH_RUNNER_VERSION="2.278.0"
 ARG TARGETPLATFORM
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -14,9 +17,8 @@ RUN chmod +x /actions-runner/install_actions.sh \
   && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
   && rm /actions-runner/install_actions.sh
 
-COPY token.sh /
-RUN chmod +x /token.sh
+COPY token.sh entrypoint.sh /
+RUN chmod +x /token.sh /entrypoint.sh
 
-COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
+CMD ["/actions-runner/bin/runsvc.sh"]

Dockerfile.base

@@ -1,11 +1,17 @@
-FROM ubuntu:eoan
+FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"
 
-ARG GIT_VERSION="2.26.2"
+ARG GIT_VERSION="2.29.0"
+ARG DUMB_INIT_VERSION="1.2.2"
+ARG DOCKER_KEY="7EA0A9C3F273FCD8"
 
+ENV DOCKER_COMPOSE_VERSION="1.27.4"
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US:en
+ENV LC_ALL=en_US.UTF-8 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=DL3003
+# hadolint ignore=DL3003,DL4001
 RUN apt-get update && \
   apt-get install -y --no-install-recommends \
     awscli \
@@ -19,13 +25,24 @@ RUN apt-get update && \
     software-properties-common \
     build-essential \
     zlib1g-dev \
+    zstd \
     gettext \
     liblttng-ust0 \
     libcurl4-openssl-dev \
     inetutils-ping \
     jq \
+    wget \
+    dirmngr \
+    openssh-client \
+    locales \
+    python3-pip \
+    jq \
+  && pip3 install --no-cache-dir awscliv2 \
+  && locale-gen en_US.UTF-8 \
+  && dpkg-reconfigure locales \
   && c_rehash \
   && cd /tmp \
+  && [[ $(lsb_release -cs) == "xenial" ]] && ( wget --quiet "https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_$(uname -i | sed 's/x86_64/amd64/g').deb" && dpkg -i dumb-init_*.deb && rm dumb-init_*.deb ) || ( apt-get install -y --no-install-recommends dumb-init ) \
   && curl -sL https://www.kernel.org/pub/software/scm/git/git-${GIT_VERSION}.tar.gz -o git.tgz \
   && tar zxf git.tgz \
   && cd git-${GIT_VERSION} \
@@ -33,11 +50,12 @@ RUN apt-get update && \
   && make \
   && make install \
   && cd / \
+  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${DOCKER_KEY} \
   && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-  && [[ $(lsb_release -cs) == "eoan" ]] && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu disco stable" ) || ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" ) \
+  && [[ $(lsb_release -cs) == "focal" ]] && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu focal stable" ) || ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" ) \
   && apt-get update \
-  && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends \
-  && curl -sL "https://github.com/docker/compose/releases/download/1.25.4/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose \
+  && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
+  && [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose ) \
   && chmod +x /usr/local/bin/docker-compose \
   && rm -rf /var/lib/apt/lists/* \
   && rm -rf /tmp/*

README.md

@@ -1,19 +1,52 @@
 Docker Github Actions Runner
 ============================
 
-[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner)
+[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner) [![awesome-runners](https://img.shields.io/badge/listed%20on-awesome--runners-blue.svg)](https://github.com/jonico/awesome-runners)
 
 This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).
 
-This has been tested and verified on:
+## Notes ##
 
- * x86_64
- * armv7
- * arm64
- 
-**NOTE:**
-- **Only one runner can use the same RUNNER_WORKDIR if it is shared storage.**
-- **RUNNER_WORKDIR must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files.**
+### Docker Support ###
+
+Please note that while this runner installs and allows docker, github actions itself does not support using docker from a self hosted runner yet. 
+For more information:
+
+* https://github.com/actions/runner/issues/406
+* https://github.com/actions/runner/issues/367
+
+### Docker-Compose on ARM ###
+
+Please note `docker-compose` does not currently work on ARM ([see issue](https://github.com/docker/compose/issues/6831)) so it is not installed on ARM based builds here.
+A workaround exists, please see [here](https://github.com/myoung34/docker-github-actions-runner/issues/72#issuecomment-804723656)
+
+## Docker Artifacts ##
+
+| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
+| --- | --- | --- | --- | --- | --- |
+| ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. | Tags without an OS name *before* 9/17/2020 are `eoan`. `armv7` support stopped 9/18/2020 due to inconsistent docker-ce packaging |
+| ubuntu eoan | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+/` | | | This is deprecated as of 9/17/2020 and will no longer receive tags or be latest. Tags without an OS name before 9/17/2020 are eoan|
+| ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| ubuntu xenial | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). | `armv7` support stopped 9/18/2020 due to lack of support for [dumb-init](https://github.com/Yelp/dumb-init/releases) |
+
+These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
+
+## Environment Variables ##
+
+| Environment Variable | Description |
+| --- | --- |
+| `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
+| `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
+| `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
+| `ORG_RUNNER` | Only valid if using `ACCESS_TOKEN`. This will set the runner to an org runner. Default is 'false'. Valid values are 'true' or 'false'. If this is set to true you must also set `ORG_NAME` and makes `REPO_URL` unneccesary |
+| `ORG_NAME` | The organization name for the runner to register under. Requires `ORG_RUNNER` to be 'true'. No default value. |
+| `LABELS` | A comma separated string to indicate the labels. Default is 'default' |
+| `REPO_URL` | If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo' |
+| `RUNNER_TOKEN` | If not using a PAT for `ACCESS_TOKEN` this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. `ACCESS_TOKEN` is likely preferred. |
+| `RUNNER_WORKDIR` | The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files. |
+| `RUNNER_GROUP` | Name of the runner group to add this runner to (defaults to the default runner group) |
+| `GITHUB_HOST` | Optional URL of the Github Enterprise server e.g github.mycompany.com. Defaults to `github.com`. |
+| `DISABLE_AUTOMATIC_DEREGISTRATION` | Optional flag to disable signal catching for deregistration. Default is `false`. Any value other than exactly `false` is considered `true`. See [here](https://github.com/myoung34/docker-github-actions-runner/issues/94) |
 
 ## Examples ##
 
@@ -23,12 +56,13 @@ If you're using a RHEL based OS with SELinux, add `--security-opt=label=disable`
 
 ### Manual ###
 
-```
-# org runner 
+```shell
+# org runner
 docker run -d --restart always --name github-runner \
   -e RUNNER_NAME_PREFIX="myrunner" \
   -e ACCESS_TOKEN="footoken" \
   -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e RUNNER_GROUP="my-group" \
   -e ORG_RUNNER="true" \
   -e ORG_NAME="octokode" \
   -e LABELS="my-label,other-label" \
@@ -41,6 +75,7 @@ docker run -d --restart always --name github-runner \
   -e RUNNER_NAME="foo-runner" \
   -e RUNNER_TOKEN="footoken" \
   -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e RUNNER_GROUP="my-group" \
   -v /var/run/docker.sock:/var/run/docker.sock \
   -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
   myoung34/github-runner:latest
@@ -48,7 +83,7 @@ docker run -d --restart always --name github-runner \
 
 Or shell wrapper:
 
-```
+```shell
 function github-runner {
     name=github-runner-${1//\//-}
     org=$(dirname $1)
@@ -60,6 +95,7 @@ function github-runner {
         -e RUNNER_TOKEN="$2" \
         -e RUNNER_NAME="linux-${repo}" \
         -e RUNNER_WORKDIR="/tmp/github-runner-${repo}" \
+        -e RUNNER_GROUP="my-group" \
         -e LABELS="my-label,other-label" \
         -v /var/run/docker.sock:/var/run/docker.sock \
         -v /tmp/github-runner-${repo}:/tmp/github-runner-${repo} \
@@ -71,18 +107,19 @@ github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-
 ```
 
 Or `docker-compose.yml`:
+
 ```yml
 version: '2.3'
 
 services:
   worker:
-    build: .
     image: myoung34/github-runner:latest
     environment:
       REPO_URL: https://github.com/example/repo
       RUNNER_NAME: example-name
       RUNNER_TOKEN: someGithubTokenHere
       RUNNER_WORKDIR: /tmp/runner/work
+      RUNNER_GROUP: my-group
       ORG_RUNNER: 'false'
       LABELS: linux,x64,gpu
     security_opt:
@@ -91,14 +128,14 @@ services:
     volumes:
       - '/var/run/docker.sock:/var/run/docker.sock'
       - '/tmp/runner:/tmp/runner'
-      # note: a quirk of docker-in-docker is that this path 
+      # note: a quirk of docker-in-docker is that this path
       # needs to be the same path on host and inside the container,
       # docker mgmt cmds run outside of docker but expect the paths from within
 ```
 
 ### Nomad ###
 
-```
+```hcl
 job "github_runner" {
   datacenters = ["home"]
   type = "system"
@@ -108,16 +145,20 @@ job "github_runner" {
 
     env {
       ACCESS_TOKEN       = "footoken"
-      RUNNER_NAME_PREFIX = "myrunner" \
+      RUNNER_NAME_PREFIX = "myrunner"
       RUNNER_WORKDIR     = "/tmp/github-runner-your-repo"
+      RUNNER_GROUP       = "my-group"
       ORG_RUNNER         = "true"
       ORG_NAME           = "octokode"
       LABELS             = "my-label,other-label"
     }
 
     config {
-      privileged = true
       image = "myoung34/github-runner:latest"
+      
+      privileged  = true
+      userns_mode = "host"
+
       volumes = [
         "/var/run/docker.sock:/var/run/docker.sock",
         "/tmp/github-runner-your-repo:/tmp/github-runner-your-repo",
@@ -129,7 +170,7 @@ job "github_runner" {
 
 ### Kubernetes ###
 
-```
+```yml
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -156,8 +197,10 @@ spec:
       - name: runner
         image: myoung34/github-runner:latest
         env:
+        - name: ACCESS_TOKEN
+          value: foo-access-token
         - name: ORG_RUNNER
-          value: true
+          value: "true"
         - name: ORG_NAME
           value: octokode
         - name: LABELS
@@ -174,6 +217,8 @@ spec:
               fieldPath: metadata.name
         - name: RUNNER_WORKDIR
           value: /tmp/github-runner-your-repo
+        - name: RUNNER_GROUP
+          value: my-group
         volumeMounts:
         - name: dockersock
           mountPath: /var/run/docker.sock
@@ -183,7 +228,7 @@ spec:
 
 ## Usage From GH Actions Workflow ##
 
-```
+```yml
 name: Package
 
 on:
@@ -203,11 +248,12 @@ jobs:
 
 A runner token can be automatically acquired at runtime if `ACCESS_TOKEN` (a GitHub personal access token) is a supplied. This uses the [GitHub Actions API](https://developer.github.com/v3/actions/self_hosted_runners/#create-a-registration-token). e.g.:
 
-```
+```shell
 docker run -d --restart always --name github-runner \
   -e ACCESS_TOKEN="footoken" \
   -e RUNNER_NAME="foo-runner" \
   -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e RUNNER_GROUP="my-group" \
   -e ORG_RUNNER="true" \
   -e ORG_NAME="octokode" \
   -e LABELS="my-label,other-label" \
@@ -215,3 +261,17 @@ docker run -d --restart always --name github-runner \
   -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
   myoung34/github-runner:latest
 ```
+
+## Create GitHub personal access token  ##
+
+Creating GitHub personal access token (PAT) for using by self-hosted runner make sure the following scopes are selected:
+
+* repo (all)
+* admin:org (all) **_(mandatory for organization-wide runner)_**
+* admin:public_key - read:public_key
+* admin:repo_hook - read:repo_hook
+* admin:org_hook
+* notifications
+* workflow
+
+Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.

SECURITY.md

@@ -0,0 +1,23 @@
+## Security
+
+If you believe you have found a security vulnerability, please report it to me as described below.
+
+## Reporting Security Issues
+
+**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).  
+
+If you'd like to communicate securely, my keybase is [here](https://keybase.io/3vilpenguin)
+
+Please include the requested information listed below (as much as you can provide) to help better understand the nature and scope of the possible issue:
+
+  * Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
+  * Full paths of source file(s) related to the manifestation of the issue
+  * The location of the affected source code (tag/branch/commit or direct URL)
+  * Any special configuration required to reproduce the issue
+  * Step-by-step instructions to reproduce the issue
+  * Proof-of-concept or exploit code (if possible)
+  * Impact of the issue, including how an attacker might exploit the issue
+
+## Preferred Languages
+
+I prefer all communications to be in English.

entrypoint.sh

@@ -1,4 +1,4 @@
-#!/bin/bash
+#!/usr/bin/dumb-init /bin/bash
 
 export RUNNER_ALLOW_RUNASROOT=1
 export PATH=$PATH:/actions-runner
@@ -11,10 +11,18 @@ deregister_runner() {
   exit
 }
 
+_DISABLE_AUTOMATIC_DEREGISTRATION=${DISABLE_AUTOMATIC_DEREGISTRATION:-false}
+
 _RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo '')}
 _RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
 _LABELS=${LABELS:-default}
+_RUNNER_GROUP=${RUNNER_GROUP:-Default}
 _SHORT_URL=${REPO_URL}
+_GITHUB_HOST=${GITHUB_HOST:="github.com"}
+
+if [[ ${ORG_RUNNER} == "true" ]]; then
+  _SHORT_URL="https://${_GITHUB_HOST}/${ORG_NAME}"
+fi
 
 if [[ -n "${ACCESS_TOKEN}" ]]; then
   _TOKEN=$(bash /token.sh)
@@ -29,10 +37,14 @@ echo "Configuring"
     --name "${_RUNNER_NAME}" \
     --work "${_RUNNER_WORKDIR}" \
     --labels "${_LABELS}" \
+    --runnergroup "${_RUNNER_GROUP}" \
     --unattended \
     --replace
 
 unset RUNNER_TOKEN
-trap deregister_runner SIGINT SIGQUIT SIGTERM
 
-./bin/runsvc.sh
+if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
+  trap deregister_runner SIGINT SIGQUIT SIGTERM
+fi
+
+$@ 

token.sh

@@ -1,8 +1,15 @@
 #!/bin/bash
 
 _ORG_RUNNER=${ORG_RUNNER:-false}
+_GITHUB_HOST=${GITHUB_HOST:="github.com"}
+
+# If URL is not github.com then use the enterprise api endpoint
+if [[ ${GITHUB_HOST} = "github.com" ]]; then
+    URI="https://api.${_GITHUB_HOST}"
+else
+    URI="https://${_GITHUB_HOST}/api/v3"
+fi
 
-URI=https://api.github.com
 API_VERSION=v3
 API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
 AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
@@ -19,7 +26,7 @@ _FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
 if [[ ${_ORG_RUNNER} == "true" ]]; then
   [[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
   _FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
-  _SHORT_URL="${_PROTO}github.com/${ORG_NAME}"
+  _SHORT_URL="${_PROTO}${_GITHUB_HOST}/${ORG_NAME}"
 else
   _SHORT_URL=$REPO_URL
 fi