[Automated 🤖 ] Bump to version 2.285.1

Fix configure command when EPHEMERAL is disabled

.github/workflows/base.yml

@@ -3,6 +3,7 @@ on:
   push:
     paths:
       - Dockerfile.base
+      - .github/workflows/base.yml
     branches:
       - master
       - develop
@@ -17,7 +18,7 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -28,14 +29,19 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
   ubuntu_base_bionic_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -48,14 +54,24 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_base_xenial_deploy:
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+
+  debian_base_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [buster, bullseye, sid]
+      fail-fast: false
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -64,8 +80,13 @@ jobs:
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
     - name: Copy Dockerfile
-      run: cp Dockerfile.base Dockerfile.base.ubuntu-xenial; sed -i.bak 's/FROM.*/FROM ubuntu:xenial/' Dockerfile.base.ubuntu-xenial
+      run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.base.ubuntu-xenial -t ${ORG}/github-runner-base:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.base.debian-${{ matrix.release }} -t ${ORG}/github-runner-base:debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .

.github/workflows/deploy.yml

@@ -17,7 +17,7 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -28,14 +28,19 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
   ubuntu_bionic_deploy:
     runs-on: ubuntu-latest
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -48,14 +53,24 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_xenial_deploy:
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+
+  debian_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [buster, bullseye, sid]
+      fail-fast: false
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -64,8 +79,13 @@ jobs:
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
     - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-xenial; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-xenial/" Dockerfile.ubuntu-xenial
+      run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.debian-${{ matrix.release }} -t ${ORG}/github-runner:debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .

.github/workflows/release.yml

@@ -28,9 +28,9 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -41,7 +41,12 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
   ubuntu_bionic_tag:
     runs-on: ubuntu-latest
     needs: create-release
@@ -49,9 +54,9 @@ jobs:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -64,17 +69,27 @@ jobs:
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-  ubuntu_xenial_tag:
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+
+  debian_tag:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [buster, bullseye, sid]
+      fail-fast: false
     needs: create-release
     steps:
     - name: Copy Repo Files
       uses: actions/checkout@master
     - name: get version
-      run: echo ::set-env name=TAG::${GITHUB_REF#refs/tags/}
+      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
     - name: Get GitHub organization or user
-      run: echo ::set-env name=ORG::$(dirname ${GITHUB_REPOSITORY})
+      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
     - name: Set up Docker Buildx
       id: buildx
       uses: crazy-max/ghaction-docker-buildx@v1
@@ -83,8 +98,13 @@ jobs:
     - name: Available platforms
       run: echo ${{ steps.buildx.outputs.platforms }}
     - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-xenial; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-xenial/" Dockerfile.ubuntu-xenial
+      run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
     - name: Login
       run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
     - name: Build
-      run: docker buildx build -f Dockerfile.ubuntu-xenial -t ${ORG}/github-runner:${TAG}-ubuntu-xenial --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
+      uses: nick-invision/retry@v2
+      with:
+        max_attempts: 3
+        retry_on: error
+        timeout_minutes: 120
+        command: docker buildx build -f Dockerfile.debian-${{ matrix.release }} -t ${ORG}/github-runner:${TAG}-debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .

.pre-commit-config.yaml

@@ -3,6 +3,7 @@ repos:
   rev: 1.0.2
   hooks:
   - id: shell-lint
+    args: [-e, SC1008]
 - repo: https://github.com/stratasan/hadolint-pre-commit
   rev: cdefcb096e520a6daa9552b1d4636f5f1e1729cd
   hooks:

.tool-versions

@@ -0,0 +1 @@
+shellcheck 0.7.0

CHANGELOG.md

@@ -0,0 +1,3 @@
+6/3/2021 (latest)
+
+ * `ORG_RUNNER` is now deprecated in favor of `RUNNER_SCOPE`. If you are currently using `ORG_RUNNER` please drop that in favor of `RUNNER_SCOPE="org"`

Dockerfile

@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache
 
-ARG GH_RUNNER_VERSION="2.274.2"
+ARG GH_RUNNER_VERSION="2.285.1"
 ARG TARGETPLATFORM
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -17,9 +17,8 @@ RUN chmod +x /actions-runner/install_actions.sh \
   && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
   && rm /actions-runner/install_actions.sh
 
-COPY token.sh /
-RUN chmod +x /token.sh
+COPY token.sh entrypoint.sh ephemeral-runner.sh /
+RUN chmod +x /token.sh /entrypoint.sh /ephemeral-runner.sh
 
-COPY entrypoint.sh /
-RUN chmod +x /entrypoint.sh
 ENTRYPOINT ["/entrypoint.sh"]
+CMD ["./bin/Runner.Listener", "run", "--startuptype", "service"]

Dockerfile.base

@@ -1,17 +1,25 @@
 FROM ubuntu:focal
 LABEL maintainer="myoung34@my.apsu.edu"
 
+# TODO: Ubuntu focal (20.04) has git v2.25, but the minimum needed for GitHub
+# Actions runners is v2.29.  For now, we build git from source.  When updating
+# to hirsute (21.04) or later, we can remove the instructions to build from
+# source in favor of the regular Ubuntu git package.
 ARG GIT_VERSION="2.29.0"
+
 ARG DUMB_INIT_VERSION="1.2.2"
 ARG DOCKER_KEY="7EA0A9C3F273FCD8"
 
 ENV DOCKER_COMPOSE_VERSION="1.27.4"
-
+ENV LANG=en_US.UTF-8
+ENV LANGUAGE=en_US.UTF-8
+ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
 # hadolint ignore=DL3003,DL4001
-RUN apt-get update && \
-  apt-get install -y --no-install-recommends \
+RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
+  && apt-get update \
+  && apt-get install -y --no-install-recommends \
     awscli \
     curl \
     tar \
@@ -19,10 +27,12 @@ RUN apt-get update && \
     apt-transport-https \
     ca-certificates \
     sudo \
-    gnupg-agent \
+    gpg-agent \
+    gnupg \
     software-properties-common \
     build-essential \
     zlib1g-dev \
+    zstd \
     gettext \
     liblttng-ust0 \
     libcurl4-openssl-dev \
@@ -31,9 +41,13 @@ RUN apt-get update && \
     wget \
     dirmngr \
     openssh-client \
+    locales \
+    python3-pip \
+    python \
+    dumb-init \
+  && pip3 install --no-cache-dir awscliv2 \
   && c_rehash \
   && cd /tmp \
-  && [[ $(lsb_release -cs) == "xenial" ]] && ( wget --quiet "https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_$(uname -i | sed 's/x86_64/amd64/g').deb" && dpkg -i dumb-init_*.deb && rm dumb-init_*.deb ) || ( apt-get install -y --no-install-recommends dumb-init ) \
   && curl -sL https://www.kernel.org/pub/software/scm/git/git-${GIT_VERSION}.tar.gz -o git.tgz \
   && tar zxf git.tgz \
   && cd git-${GIT_VERSION} \
@@ -41,12 +55,16 @@ RUN apt-get update && \
   && make \
   && make install \
   && cd / \
+  # Determine the Distro name (Debian, Ubuntu, etc)
+  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
+  # Determine the Distro version (bullseye, xenial, etc)
+  # Note: sid is aliased to bullseye, because Docker doesn't have a matching apt repo
   && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${DOCKER_KEY} \
-  && curl -fsSL https://download.docker.com/linux/ubuntu/gpg | apt-key add - \
-  && [[ $(lsb_release -cs) == "focal" ]] && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu focal stable" ) || ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/ubuntu $(lsb_release -cs) stable" ) \
+  && curl -fsSL https://download.docker.com/linux/${distro}/gpg | apt-key add - \
+  && version=$(lsb_release -cs | awk '{gsub("sid", "bullseye"); print $0}') \
+  && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/${distro} ${version} stable" ) \
   && apt-get update \
   && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
-  && curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose \
-  && chmod +x /usr/local/bin/docker-compose \
+  && [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) \
   && rm -rf /var/lib/apt/lists/* \
   && rm -rf /tmp/*

README.md

@@ -1,18 +1,37 @@
 Docker Github Actions Runner
 ============================
 
-[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner)
+[![Docker Pulls](https://img.shields.io/docker/pulls/myoung34/github-runner.svg)](https://hub.docker.com/r/myoung34/github-runner) [![awesome-runners](https://img.shields.io/badge/listed%20on-awesome--runners-blue.svg)](https://github.com/jonico/awesome-runners)
 
 This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).
 
+## Notes ##
+
+### Docker Support ###
+
+Please note that while this runner installs and allows docker, github actions itself does not support using docker from a self hosted runner yet.
+For more information:
+
+* https://github.com/actions/runner/issues/406
+* https://github.com/actions/runner/issues/367
+
+Also, some GitHub Actions Workflow features, like [Job Services](https://docs.github.com/en/actions/guides/about-service-containers), won't be usable and [will result in an error](https://github.com/myoung34/docker-github-actions-runner/issues/61).
+
+### Docker-Compose on ARM ###
+
+Please note `docker-compose` does not currently work on ARM ([see issue](https://github.com/docker/compose/issues/6831)) so it is not installed on ARM based builds here.
+A workaround exists, please see [here](https://github.com/myoung34/docker-github-actions-runner/issues/72#issuecomment-804723656)
+
 ## Docker Artifacts ##
 
 | Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
 | --- | --- | --- | --- | --- | --- |
 | ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. | Tags without an OS name *before* 9/17/2020 are `eoan`. `armv7` support stopped 9/18/2020 due to inconsistent docker-ce packaging |
-| ubuntu eoan | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+/` | | | This is deprecated as of 9/17/2020 and will no longer receive tags or be latest. Tags without an OS name before 9/17/2020 are eoan|
 | ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
-| ubuntu xenial | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). | `armv7` support stopped 9/18/2020 due to lack of support for [dumb-init](https://github.com/Yelp/dumb-init/releases) |
+| debian buster | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | This is the latest build from buster (Rebuilt nightly and on master merges). Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Buster is Debians current old-stable release. |
+| debian bullseye | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Bullseye is Debians current stable release. |
+| debian sid | `x86_64`,`arm64`,`admv7` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Sid is considered unstable by Debian. |
+| ubuntu xenial | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). | This is deprecated as of 7/15/2021 and will no longer receive tags. |
 
 These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
 
@@ -23,13 +42,18 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
 | `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
 | `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
-| `ORG_RUNNER` | Only valid if using `ACCESS_TOKEN`. This will set the runner to an org runner. Default is 'false'. Valid values are 'true' or 'false'. If this is set to true you must also set `ORG_NAME` and makes `REPO_URL` unneccesary |
-| `ORG_NAME` | The organization name for the runner to register under. Requires `ORG_RUNNER` to be 'true'. No default value. |
+| `RUNNER_SCOPE` | The scope the runner will be registered on. Valid values are `repo`, `org` and `ent`. For 'org' and 'enterprise', `ACCESS_TOKEN` is required and `REPO_URL` is unneccesary. If 'org', requires `ORG_NAME`; if 'enterprise', requires `ENTERPRISE_NAME`. Default is 'repo'. |
+| `ORG_NAME` | The organization name for the runner to register under. Requires `RUNNER_SCOPE` to be 'org'. No default value. |
+| `ENTERPRISE_NAME` | The enterprise name for the runner to register under. Requires `RUNNER_SCOPE` to be 'enterprise'. No default value. |
 | `LABELS` | A comma separated string to indicate the labels. Default is 'default' |
 | `REPO_URL` | If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo' |
 | `RUNNER_TOKEN` | If not using a PAT for `ACCESS_TOKEN` this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. `ACCESS_TOKEN` is likely preferred. |
 | `RUNNER_WORKDIR` | The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files. |
 | `RUNNER_GROUP` | Name of the runner group to add this runner to (defaults to the default runner group) |
+| `GITHUB_HOST` | Optional URL of the Github Enterprise server e.g github.mycompany.com. Defaults to `github.com`. |
+| `DISABLE_AUTOMATIC_DEREGISTRATION` | Optional flag to disable signal catching for deregistration. Default is `false`. Any value other than exactly `false` is considered `true`. See [here](https://github.com/myoung34/docker-github-actions-runner/issues/94) |
+| `CONFIGURED_ACTIONS_RUNNER_FILES_DIR` | Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
+| `EPHEMERAL` | Optional flag to configure runner with [`--ephemeral` option](https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling). Ephemeral runners are suitable for autoscaling. |
 
 ## Examples ##
 
@@ -46,7 +70,7 @@ docker run -d --restart always --name github-runner \
   -e ACCESS_TOKEN="footoken" \
   -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
   -e RUNNER_GROUP="my-group" \
-  -e ORG_RUNNER="true" \
+  -e RUNNER_SCOPE="org" \
   -e ORG_NAME="octokode" \
   -e LABELS="my-label,other-label" \
   -v /var/run/docker.sock:/var/run/docker.sock \
@@ -64,7 +88,24 @@ docker run -d --restart always --name github-runner \
   myoung34/github-runner:latest
 ```
 
-Or shell wrapper:
+Adding the reusage of the registered runner (can be propogated to all other approaches):
+
+```shell
+# per repo
+docker run -d --restart always --name github-runner \
+  -e REPO_URL="https://github.com/myoung34/repo" \
+  -e RUNNER_NAME="foo-runner" \
+  -e RUNNER_TOKEN="footoken" \
+  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e RUNNER_GROUP="my-group" \
+  -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR="/actions-runner-files" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
+  -v /tmp/foo:/actions-runner-files \
+  myoung34/github-runner:latest
+```
+
+Shell wrapper:
 
 ```shell
 function github-runner {
@@ -82,11 +123,11 @@ function github-runner {
         -e LABELS="my-label,other-label" \
         -v /var/run/docker.sock:/var/run/docker.sock \
         -v /tmp/github-runner-${repo}:/tmp/github-runner-${repo} \
-        --name $name ${org}/github-runner:${tag}
+        --name $name myoung34/github-runner:latest
 }
 
 github-runner your-account/your-repo       AARGHTHISISYOURGHACTIONSTOKEN
-github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-xenial
+github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-focal
 ```
 
 Or `docker-compose.yml`:
@@ -103,7 +144,7 @@ services:
       RUNNER_TOKEN: someGithubTokenHere
       RUNNER_WORKDIR: /tmp/runner/work
       RUNNER_GROUP: my-group
-      ORG_RUNNER: 'false'
+      RUNNER_SCOPE: 'repo'
       LABELS: linux,x64,gpu
     security_opt:
       # needed on SELinux systems to allow docker container to manage other docker containers
@@ -128,17 +169,20 @@ job "github_runner" {
 
     env {
       ACCESS_TOKEN       = "footoken"
-      RUNNER_NAME_PREFIX = "myrunner" \
+      RUNNER_NAME_PREFIX = "myrunner"
       RUNNER_WORKDIR     = "/tmp/github-runner-your-repo"
       RUNNER_GROUP       = "my-group"
-      ORG_RUNNER         = "true"
+      RUNNER_SCOPE       = "org"
       ORG_NAME           = "octokode"
       LABELS             = "my-label,other-label"
     }
 
     config {
-      privileged = true
       image = "myoung34/github-runner:latest"
+      
+      privileged  = true
+      userns_mode = "host"
+
       volumes = [
         "/var/run/docker.sock:/var/run/docker.sock",
         "/tmp/github-runner-your-repo:/tmp/github-runner-your-repo",
@@ -177,8 +221,10 @@ spec:
       - name: runner
         image: myoung34/github-runner:latest
         env:
-        - name: ORG_RUNNER
-          value: "true"
+        - name: ACCESS_TOKEN
+          value: foo-access-token
+        - name: RUNNER_SCOPE
+          value: "org"
         - name: ORG_NAME
           value: octokode
         - name: LABELS
@@ -232,7 +278,7 @@ docker run -d --restart always --name github-runner \
   -e RUNNER_NAME="foo-runner" \
   -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
   -e RUNNER_GROUP="my-group" \
-  -e ORG_RUNNER="true" \
+  -e RUNNER_SCOPE="org" \
   -e ORG_NAME="octokode" \
   -e LABELS="my-label,other-label" \
   -v /var/run/docker.sock:/var/run/docker.sock \
@@ -246,6 +292,7 @@ Creating GitHub personal access token (PAT) for using by self-hosted runner make
 
 * repo (all)
 * admin:org (all) **_(mandatory for organization-wide runner)_**
+* admin:enterprise (all) **_(mandatory for enterprise-wide runner)_**
 * admin:public_key - read:public_key
 * admin:repo_hook - read:repo_hook
 * admin:org_hook
@@ -253,3 +300,72 @@ Creating GitHub personal access token (PAT) for using by self-hosted runner make
 * workflow
 
 Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.
+
+## Run a runner on enterprise scope  ##
+
+```shell
+docker run -d --restart always --name github-runner \
+  -e ACCESS_TOKEN="footoken" \
+  -e RUNNER_NAME="foo-runner" \
+  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
+  -e RUNNER_GROUP="my-group" \
+  -e RUNNER_SCOPE="enterprise" \
+  -e ENTERPRISE_NAME="my-enterprise" \
+  -e LABELS="my-label,other-label" \
+  -v /var/run/docker.sock:/var/run/docker.sock \
+  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
+  myoung34/github-runner:latest
+```
+
+## Ephemeral mode
+
+GitHub's hosted runners are completely ephemeral.  You can remove all its data without breaking all future jobs.
+
+To achieve the same resilience in a self-hosted runner:
+  1. override the command for your runner with `/ephemeral-runner.sh` (which will terminate after one job executes)
+  2. don't mount a local folder into `RUNNER_WORKDIR` (to ensure no filesystem persistence)
+  3. run the container with `--rm` (to delete it after termination)
+  4. wrap the container execution in a system service that restarts (to start a fresh container after each job)
+
+Here's an example service definition for systemd:
+
+```
+# Install with:
+#   sudo install -m 644 ephemeral-github-actions-runner.service /etc/systemd/system/
+#   sudo systemctl daemon-reload
+#   sudo systemctl enable ephemeral-github-actions-runner
+# Run with:
+#   sudo systemctl start ephemeral-github-actions-runner
+# Stop with:
+#   sudo systemctl stop ephemeral-github-actions-runner
+# See live logs with:
+#   journalctl -f -u ephemeral-github-actions-runner.service --no-hostname --no-tail
+
+[Unit]
+Description=Ephemeral GitHub Actions Runner Container
+After=docker.service
+Requires=docker.service
+
+[Service]
+TimeoutStartSec=0
+Restart=always
+ExecStartPre=-/usr/bin/docker stop %n
+ExecStartPre=-/usr/bin/docker rm %n
+ExecStartPre=-/usr/bin/docker pull myoung34/github-runner:latest
+ExecStart=/usr/bin/docker run --rm --env-file /etc/ephemeral-github-actions-runner.env --name %n myoung34/ephemeral-github-actions-runner:latest /ephemeral-runner.sh
+
+[Install]
+WantedBy=multi-user.target
+```
+
+And an example of the corresponding env file that the service reads from:
+
+```
+# Install with:
+#   sudo install -m 600 ephemeral-github-actions-runner.env /etc/
+REPO_URL=https://github.com/your-org/your-repo
+RUNNER_NAME=your-runner-name-here
+ACCESS_TOKEN=foo-access-token
+RUNNER_WORKDIR=/tmp/runner/work
+LABELS=any-custom-labels-go-here
+```

entrypoint.sh

@@ -3,42 +3,117 @@
 export RUNNER_ALLOW_RUNASROOT=1
 export PATH=$PATH:/actions-runner
 
+# Un-export these, so that they must be passed explicitly to the environment of
+# any command that needs them.  This may help prevent leaks.
+export -n ACCESS_TOKEN
+export -n RUNNER_TOKEN
+
 deregister_runner() {
   echo "Caught SIGTERM. Deregistering runner"
-  _TOKEN=$(bash /token.sh)
-  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  if [[ -n "${ACCESS_TOKEN}" ]]; then
+    _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
+    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  fi
   ./config.sh remove --token "${RUNNER_TOKEN}"
   exit
 }
 
+_DISABLE_AUTOMATIC_DEREGISTRATION=${DISABLE_AUTOMATIC_DEREGISTRATION:-false}
+
 _RUNNER_NAME=${RUNNER_NAME:-${RUNNER_NAME_PREFIX:-github-runner}-$(head /dev/urandom | tr -dc A-Za-z0-9 | head -c 13 ; echo '')}
 _RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
 _LABELS=${LABELS:-default}
 _RUNNER_GROUP=${RUNNER_GROUP:-Default}
-_SHORT_URL=${REPO_URL}
+_GITHUB_HOST=${GITHUB_HOST:="github.com"}
 
-if [[ ${ORG_RUNNER} == "true" ]]; then
-  _SHORT_URL="https://github.com/${ORG_NAME}"
+# ensure backwards compatibility
+if [[ -z $RUNNER_SCOPE ]]; then
+  if [[ ${ORG_RUNNER} == "true" ]]; then
+    echo 'ORG_RUNNER is now deprecated. Please use RUNNER_SCOPE="org" instead.'
+    export RUNNER_SCOPE="org"
+  else
+    export RUNNER_SCOPE="repo"
+  fi
 fi
 
-if [[ -n "${ACCESS_TOKEN}" ]]; then
-  _TOKEN=$(bash /token.sh)
-  RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
-  _SHORT_URL=$(echo "${_TOKEN}" | jq -r .short_url)
+RUNNER_SCOPE="${RUNNER_SCOPE,,}" # to lowercase
+
+case ${RUNNER_SCOPE} in
+  org*)
+    [[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
+    _SHORT_URL="https://${_GITHUB_HOST}/${ORG_NAME}"
+    RUNNER_SCOPE="org"
+    ;;
+
+  ent*)
+    [[ -z ${ENTERPRISE_NAME} ]] && ( echo "ENTERPRISE_NAME required for enterprise runners"; exit 1 )
+    _SHORT_URL="https://${_GITHUB_HOST}/enterprises/${ENTERPRISE_NAME}"
+    RUNNER_SCOPE="enterprise"
+    ;;
+
+  *)
+    [[ -z ${REPO_URL} ]] && ( echo "REPO_URL required for repo runners"; exit 1 )
+    _SHORT_URL=${REPO_URL}
+    RUNNER_SCOPE="repo"
+    ;;
+esac
+
+configure_runner() {
+  if [[ -n "${ACCESS_TOKEN}" ]]; then
+    echo "Obtaining the token of the runner"
+    _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
+    RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
+  fi
+
+  if [ -n "${EPHEMERAL}" ]; then
+    echo "Ephemeral option is enabled"
+    _EPHEMERAL="--ephemeral"
+  else
+    _EPHEMERAL=""
+  fi
+
+  echo "Configuring"
+  ./config.sh \
+      --url "${_SHORT_URL}" \
+      --token "${RUNNER_TOKEN}" \
+      --name "${_RUNNER_NAME}" \
+      --work "${_RUNNER_WORKDIR}" \
+      --labels "${_LABELS}" \
+      --runnergroup "${_RUNNER_GROUP}" \
+      --unattended \
+      --replace ${_EPHEMERAL}
+}
+
+
+# Opt into runner reusage because a value was given
+if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Runner reusage is enabled"
+
+  # directory exists, copy the data
+  if [[ -d "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+    echo "Copying previous data"
+    cp -p -r "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}/." "/actions-runner"
+  fi
+
+  if [ -f "/actions-runner/.runner" ]; then
+    echo "The runner has already been configured"
+  else
+    configure_runner
+  fi
+else
+  echo "Runner reusage is disabled"
+  configure_runner
 fi
 
-echo "Configuring"
-./config.sh \
-    --url "${_SHORT_URL}" \
-    --token "${RUNNER_TOKEN}" \
-    --name "${_RUNNER_NAME}" \
-    --work "${_RUNNER_WORKDIR}" \
-    --labels "${_LABELS}" \
-    --runnergroup "${_RUNNER_GROUP}" \
-    --unattended \
-    --replace
+if [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]]; then
+  echo "Reusage is enabled. Storing data to ${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+  # Quoting (even with double-quotes) the regexp brokes the copying
+  cp -p -r "/actions-runner/_diag" "/actions-runner/svc.sh" /actions-runner/.[^.]* "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+fi
 
-unset RUNNER_TOKEN
-trap deregister_runner SIGINT SIGQUIT SIGTERM
+if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
+  trap deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
+fi
 
-./bin/runsvc.sh
+# Container's command (CMD) execution
+"$@"

ephemeral-runner.sh

@@ -0,0 +1,36 @@
+#!/bin/bash
+
+echo "*** Starting ephemeral runner. ***"
+/actions-runner/run.sh --once
+rv=$?
+
+# See exit code constants in the runner source here:
+# https://github.com/actions/runner/blob/be96323/src/Runner.Common/Constants.cs#L135
+if [[ $rv == 4 ]]; then
+  # The runner software was updated.
+  echo "*** Software update detected. ***"
+
+  echo "*** Waiting for update to complete. ***"
+  # Hard-coded sleep.  Without some delay, the update is still in progress in
+  # the background, leading to failures when we re-launch.
+  sleep 10
+
+  # Now add an adaptive delay, where we loop and check if the Runner is usable
+  # yet.  As soon as it is, break.
+  for i in $(seq 10); do
+    if /actions-runner/bin/Runner.Listener --version &>/dev/null; then
+      break
+    fi
+
+    echo "*** Update still in progress... ***"
+    sleep 5
+  done
+
+  # Now re-launch the script.
+  echo "*** Re-launching runner. ***"
+  exec "$0"
+fi
+
+# For any other return value, let the script and the Docker container terminate.
+echo "*** Exit code $rv ***"
+exit $rv

install_actions.sh

@@ -1,4 +1,4 @@
-#!/bin/bash -x
+#!/bin/bash -ex
 GH_RUNNER_VERSION=$1
 TARGETPLATFORM=$2
 

token.sh

@@ -1,28 +1,37 @@
 #!/bin/bash
 
-_ORG_RUNNER=${ORG_RUNNER:-false}
+_GITHUB_HOST=${GITHUB_HOST:="github.com"}
+
+# If URL is not github.com then use the enterprise api endpoint
+if [[ ${GITHUB_HOST} = "github.com" ]]; then
+  URI="https://api.${_GITHUB_HOST}"
+else
+  URI="https://${_GITHUB_HOST}/api/v3"
+fi
 
-URI=https://api.github.com
 API_VERSION=v3
 API_HEADER="Accept: application/vnd.github.${API_VERSION}+json"
 AUTH_HEADER="Authorization: token ${ACCESS_TOKEN}"
 
-REPO_URL=${REPO_URL:-${URI}}
-_PROTO="$(echo "${REPO_URL}" | grep :// | sed -e's,^\(.*://\).*,\1,g')"
-# shellcheck disable=SC2116
-_URL="$(echo "${REPO_URL/${_PROTO}/}")"
-_PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
-_ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
-_REPO="$(echo "${_PATH}" | cut -d/ -f2)"
+case ${RUNNER_SCOPE} in
+  org*)
+    _FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
+    ;;
 
-_FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
-if [[ ${_ORG_RUNNER} == "true" ]]; then
-  [[ -z ${ORG_NAME} ]] && ( echo "ORG_NAME required for org runners"; exit 1 )
-  _FULL_URL="${URI}/orgs/${ORG_NAME}/actions/runners/registration-token"
-  _SHORT_URL="${_PROTO}github.com/${ORG_NAME}"
-else
-  _SHORT_URL=$REPO_URL
-fi
+  ent*)
+    _FULL_URL="${URI}/enterprises/${ENTERPRISE_NAME}/actions/runners/registration-token"
+    ;;
+
+  *)
+    _PROTO="https://"
+    # shellcheck disable=SC2116
+    _URL="$(echo "${REPO_URL/${_PROTO}/}")"
+    _PATH="$(echo "${_URL}" | grep / | cut -d/ -f2-)"
+    _ACCOUNT="$(echo "${_PATH}" | cut -d/ -f1)"
+    _REPO="$(echo "${_PATH}" | cut -d/ -f2)"
+    _FULL_URL="${URI}/repos/${_ACCOUNT}/${_REPO}/actions/runners/registration-token"
+    ;;
+esac
 
 RUNNER_TOKEN="$(curl -XPOST -fsSL \
   -H "${AUTH_HEADER}" \
@@ -30,4 +39,4 @@ RUNNER_TOKEN="$(curl -XPOST -fsSL \
   "${_FULL_URL}" \
 | jq -r '.token')"
 
-echo "{\"token\": \"${RUNNER_TOKEN}\", \"short_url\": \"${_SHORT_URL}\", \"full_url\": \"${_FULL_URL}\"}"
+echo "{\"token\": \"${RUNNER_TOKEN}\", \"full_url\": \"${_FULL_URL}\"}"