[Automated 🤖 ] Bump to version 2.296.2

Merge pull request #234 from Rumbles/master
Check to see if not running as root
2022-09-08 12:46:35 -05:00 · 2022-09-06 19:41:53 -05:00 · 2022-09-06 19:24:04 -05:00 · 2022-09-06 09:59:23 -04:00 · 2022-09-02 12:26:29 +02:00 · 2022-09-02 12:23:31 +02:00
9 changed files with 343 additions and 598 deletions
@@ -10,57 +10,69 @@ on:
  schedule:
    - cron:  '0 22 * * *'

-
 jobs:
  ubuntu_base_latest_deploy:
    runs-on: ubuntu-latest
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.base -t ${ORG}/github-runner-base:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
-  ubuntu_base_bionic_deploy:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.base
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner-base:latest
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          
+  ubuntu_base_deploy:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile.base Dockerfile.base.ubuntu-bionic; sed -i.bak 's/FROM.*/FROM ubuntu:bionic/' Dockerfile.base.ubuntu-bionic
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.base.ubuntu-bionic -t ${ORG}/github-runner-base:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
-
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.base.ubuntu-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+          
  debian_base_deploy:
    runs-on: ubuntu-latest
    strategy:
@@ -68,25 +80,29 @@ jobs:
        release: [bullseye, sid]
      fail-fast: false
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.base.debian-${{ matrix.release }} -t ${ORG}/github-runner-base:debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile.base Dockerfile.base.debian-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM debian:${{ matrix.release }}/' Dockerfile.base.debian-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.base.debian-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
@@ -14,51 +14,66 @@ jobs:
  ubuntu_latest_deploy:
    runs-on: ubuntu-latest
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile -t ${ORG}/github-runner:latest --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
-  ubuntu_bionic_deploy:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Update Dockerfile FROM org
+        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile        
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:latest
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  ubuntu_deploy:
    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.ubuntu-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{env.ORG}}/github-runner:ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

  debian_deploy:
    runs-on: ubuntu-latest
@@ -67,25 +82,29 @@ jobs:
        release: [bullseye, sid]
      fail-fast: false
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.debian-${{ matrix.release }} -t ${ORG}/github-runner:debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.debian-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
@@ -21,60 +21,78 @@ jobs:
        release_name: Release ${{ github.ref }}
        draft: false
        prerelease: false
+
  ubuntu_latest_tag:
    runs-on: ubuntu-latest
    needs: create-release
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile -t ${ORG}/github-runner:${TAG} --output "type=image,push=true" --platform linux/amd64,linux/arm64 .
-  ubuntu_bionic_tag:
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: get version
+        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Update Dockerfile FROM org
+        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile 
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  ubuntu_tag:
    runs-on: ubuntu-latest
    needs: create-release
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.ubuntu-bionic -t ${ORG}/github-runner:${TAG}-ubuntu-bionic --output "type=image,push=true" --platform linux/amd64,linux/arm/v7,linux/arm64 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: get version
+        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Available platforms
+        run: echo ${{ steps.buildx.outputs.platforms }}
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.ubuntu-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max

  debian_tag:
    runs-on: ubuntu-latest
@@ -84,27 +102,31 @@ jobs:
      fail-fast: false
    needs: create-release
    steps:
-    - name: Copy Repo Files
-      uses: actions/checkout@master
-    - name: get version
-      run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
-    - name: Get GitHub organization or user
-      run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
-    - name: Set up Docker Buildx
-      id: buildx
-      uses: crazy-max/ghaction-docker-buildx@v1
-      with:
-        buildx-version: latest
-    - name: Available platforms
-      run: echo ${{ steps.buildx.outputs.platforms }}
-    - name: Copy Dockerfile
-      run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
-    - name: Login
-      run: docker login -u ${{ secrets.DOCKER_USER }} -p ${{ secrets.DOCKER_TOKEN }}
-    - name: Build
-      uses: nick-invision/retry@v2
-      with:
-        max_attempts: 3
-        retry_on: error
-        timeout_minutes: 120
-        command: docker buildx build -f Dockerfile.debian-${{ matrix.release }} -t ${ORG}/github-runner:${TAG}-debian-${{ matrix.release }} --output "type=image,push=true" --platform linux/amd64,linux/arm64,linux/arm/v7 .
+      - name: Copy Repo Files
+        uses: actions/checkout@master
+      - name: get version
+        run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
+      - name: Get GitHub organization or user
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v1
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v1
+      - name: Copy Dockerfile
+        run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
+      - name: Login to DockerHub
+        uses: docker/login-action@v1
+        with:
+          username: ${{ secrets.DOCKER_USER }}
+          password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Build and push
+        uses: docker/build-push-action@v2
+        with:
+          context: .
+          file: Dockerfile.debian-${{ matrix.release }}
+          pull: true
+          push: true
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache

-ARG GH_RUNNER_VERSION="2.287.0"
+ARG GH_RUNNER_VERSION="2.296.2"
 ARG TARGETPLATFORM

 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -13,15 +13,13 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 WORKDIR /actions-runner
 COPY install_actions.sh /actions-runner

-# TODO: remove this terrible sed once
-#  https://github.com/actions/runner/pull/1585 is merged or similar
 RUN chmod +x /actions-runner/install_actions.sh \
-  && sed -i.bak 's/.\/bin\/installdependencies.sh/wget https:\/\/raw.githubusercontent.com\/myoung34\/runner\/main\/src\/Misc\/layoutbin\/installdependencies.sh -O .\/bin\/installdependencies.sh; bash .\/bin\/installdependencies.sh/g' /actions-runner/install_actions.sh \
  && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
-  && rm /actions-runner/install_actions.sh
+  && rm /actions-runner/install_actions.sh \
+  && chown runner /_work /actions-runner /opt/hostedtoolcache

-COPY token.sh entrypoint.sh ephemeral-runner.sh /
-RUN chmod +x /token.sh /entrypoint.sh /ephemeral-runner.sh
+COPY token.sh entrypoint.sh /
+RUN chmod +x /token.sh /entrypoint.sh

 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["./bin/Runner.Listener", "run", "--startuptype", "service"]
@@ -3,9 +3,9 @@ LABEL maintainer="myoung34@my.apsu.edu"

 ARG DUMB_INIT_VERSION="1.2.2"
 ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
-ARG DOCKER_KEY="7EA0A9C3F273FCD8"

 ENV DOCKER_COMPOSE_VERSION="1.27.4"
+ENV GIT_LFS_VERSION="3.2.0"
 ENV LANG=en_US.UTF-8
 ENV LANGUAGE=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
@@ -18,6 +18,8 @@ RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
  && apt-get update \
  && apt-get install -y --no-install-recommends \
+    gnupg \
+    lsb-release \
    curl \
    tar \
    unzip \
@@ -38,26 +40,41 @@ RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
    openssh-client \
    locales \
    python3-pip \
+    python3-setuptools \
    python3 \
    dumb-init \
+    nodejs \
+    rsync \
+    gosu \
+  && DPKG_ARCH="$(dpkg --print-architecture)" \
+  && LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
+  && sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
  && echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu $([[ $(grep -E '^ID=' /etc/os-release | sed 's/.*=//g') == "ubuntu" ]] && (grep VERSION_CODENAME /etc/os-release | sed 's/.*=//g') || echo bionic) main>/etc/apt/sources.list.d/git-core.list \
  && apt-get update \
  && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git || apt-get install -y --no-install-recommends git=1:2.33.1-0ppa1~ubuntu18.04.1 git-man=1:2.33.1-0ppa1~ubuntu18.04.1 ) \
  && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
  && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
-  && curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" \
-  && unzip awscliv2.zip -d /tmp/ \
-  && /tmp/aws/install \
+  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install awscli ) \
+  && ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz  /tmp/git-lfs-${GIT_LFS_VERSION}) \
  # Determine the Distro name (Debian, Ubuntu, etc)
  && distro=$(lsb_release -is | awk '{print tolower($0)}') \
  # Determine the Distro version (bullseye, xenial, etc)
  # Note: sid is aliased to bullseye, because Docker doesn't have a matching apt repo
-  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${DOCKER_KEY} \
-  && curl -fsSL https://download.docker.com/linux/${distro}/gpg | apt-key add - \
+  && mkdir -p /etc/apt/keyrings \
+  && ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
  && version=$(lsb_release -cs | awk '{gsub("sid", "bullseye"); print $0}') \
-  && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/${distro} ${version} stable" ) \
+  && ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
  && apt-get update \
  && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
-  && [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) \
+  && ( [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/Release.key" | apt-key add - && apt-get update) || : ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" || "${LSB_RELEASE_CODENAME}" == "jammy" || "${LSB_RELEASE_CODENAME}" == "sid" || "${LSB_RELEASE_CODENAME}" == "bullseye" ]] && apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "jammy" ]] && echo "Ubuntu Jammy is marked as beta. Please see https://github.com/actions/virtual-environments/issues/5490" || : ) \
+  && GH_CLI_INSTALL_FILE="/tmp/gh-$$.deb" && curl -sSLo "${GH_CLI_INSTALL_FILE}" "https://github.com$(curl -sSL "https://github.com/cli/cli/releases/latest" | grep -Po "(?<=href=\")/cli/cli/releases/download/[^\"]*${DPKG_ARCH}[.]deb(?=\")")" && apt -y install "${GH_CLI_INSTALL_FILE}" \
  && rm -rf /var/lib/apt/lists/* \
-  && rm -rf /tmp/*
+  && rm -rf /tmp/* \
+  && groupadd -g 121 runner \
+  && useradd -mr -d /home/runner -u 1001 -g 121 runner \
+  && usermod -aG sudo runner \
+  && usermod -aG docker runner \
+  && echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers
@@ -5,11 +5,16 @@ Docker Github Actions Runner

 This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).

+## Quick-Start (Examples and Usage) ##
+
+Please see [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage)
+
 ## Notes ##

-### Auto Update Issues ###
+### Security ###

-There is a [known issue with auto updates in docker](https://github.com/actions/runner/issues/246). If one is running a version that has an update it will try to auto update and fail. The only current workaround is to run `latest` which in theory is always up to date and wont update/throttle.
+It is known that currently tokens (ACCESS_TOKEN / RUNNER_TOKEN ) are not safe from exfiltration.
+If you are using this runner make sure that any workflow changes are gated by a verification process (in the actions settings) so that malicious PR's cannot exfiltrate these.

 ### Docker Support ###

@@ -21,6 +26,10 @@ For more information:

 Also, some GitHub Actions Workflow features, like [Job Services](https://docs.github.com/en/actions/guides/about-service-containers), won't be usable and [will result in an error](https://github.com/myoung34/docker-github-actions-runner/issues/61).

+### Containerd Support ###
+
+Currently runners [do not support containerd](https://github.com/actions/runner/issues/1265)
+
 ### Docker-Compose on ARM ###

 Please note `docker-compose` does not currently work on ARM ([see issue](https://github.com/docker/compose/issues/6831)) so it is not installed on ARM based builds here.
@@ -30,12 +39,12 @@ A workaround exists, please see [here](https://github.com/myoung34/docker-github

 | Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
 | --- | --- | --- | --- | --- | --- |
-| ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. | Tags without an OS name *before* 9/17/2020 are `eoan`. `armv7` support stopped 9/18/2020 due to inconsistent docker-ce packaging |
-| ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
-| debian buster (now deprecated) | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Buster is Debians current old-stable release. |
-| debian bullseye | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Bullseye is Debians current stable release. |
-| debian sid | `x86_64`,`arm64`,`admv7` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Sid is considered unstable by Debian. |
-| ubuntu xenial | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). | This is deprecated as of 7/15/2021 and will no longer receive tags. |
+| ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` `/\d\.\d{3}\.\d+-ubuntu-focal/`| [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags).|
+| ubuntu jammy | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-jammy/` | [ubuntu-jammy](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-jammy) | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with `-ubuntu-jammy` are included and created on [upstream tags](https://github.com/actions/runner/tags). | There is [currently an issue with jammy from inside a 20.04LTS host](https://github.com/myoung34/docker-github-actions-runner/issues/219) which is why this is not `latest` |
+| ubuntu bionic | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian bullseye | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian sid | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |

 These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.

@@ -43,6 +52,7 @@ These containers are built via Github actions that [copy the dockerfile](https:/

 | Environment Variable | Description |
 | --- | --- |
+| `RUN_AS_ROOT` | Boolean to run as root. If `true`: will run as root. If `True` and the user is overriden it will error. If any other value it will run as the `runner` user and allow an optional override. Default is `true` |
 | `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
 | `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
 | `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
@@ -58,332 +68,4 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `DISABLE_AUTOMATIC_DEREGISTRATION` | Optional flag to disable signal catching for deregistration. Default is `false`. Any value other than exactly `false` is considered `true`. See [here](https://github.com/myoung34/docker-github-actions-runner/issues/94) |
 | `CONFIGURED_ACTIONS_RUNNER_FILES_DIR` | Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
 | `EPHEMERAL` | Optional flag to configure runner with [`--ephemeral` option](https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling). Ephemeral runners are suitable for autoscaling. |
-
-## Examples ##
-
-### Note ###
-
-If you're using a RHEL based OS with SELinux, add `--security-opt=label=disable` to prevent [permission denied](https://github.com/myoung34/docker-github-actions-runner/issues/9)
-
-### Manual ###
-
-```shell
-# org runner
-docker run -d --restart always --name github-runner \
-  -e RUNNER_NAME_PREFIX="myrunner" \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e RUNNER_SCOPE="org" \
-  -e ORG_NAME="octokode" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-# per repo
-docker run -d --restart always --name github-runner \
-  -e REPO_URL="https://github.com/myoung34/repo" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-Adding the reusage of the registered runner (can be propogated to all other approaches):
-
-```shell
-# per repo
-docker run -d --restart always --name github-runner \
-  -e REPO_URL="https://github.com/myoung34/repo" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR="/actions-runner-files" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  -v /tmp/foo:/actions-runner-files \
-  myoung34/github-runner:latest
-```
-
-Shell wrapper:
-
-```shell
-function github-runner {
-    name=github-runner-${1//\//-}
-    org=$(dirname $1)
-    repo=$(basename $1)
-    tag=${3:-latest}
-    docker rm -f $name
-    docker run -d --restart=always \
-        -e REPO_URL="https://github.com/${org}/${repo}" \
-        -e RUNNER_TOKEN="$2" \
-        -e RUNNER_NAME="linux-${repo}" \
-        -e RUNNER_WORKDIR="/tmp/github-runner-${repo}" \
-        -e RUNNER_GROUP="my-group" \
-        -e LABELS="my-label,other-label" \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        -v /tmp/github-runner-${repo}:/tmp/github-runner-${repo} \
-        --name $name myoung34/github-runner:latest
-}
-
-github-runner your-account/your-repo       AARGHTHISISYOURGHACTIONSTOKEN
-github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-focal
-```
-
-Or `docker-compose.yml`:
-
-```yml
-version: '2.3'
-
-services:
-  worker:
-    image: myoung34/github-runner:latest
-    environment:
-      REPO_URL: https://github.com/example/repo
-      RUNNER_NAME: example-name
-      RUNNER_TOKEN: someGithubTokenHere
-      RUNNER_WORKDIR: /tmp/runner/work
-      RUNNER_GROUP: my-group
-      RUNNER_SCOPE: 'repo'
-      LABELS: linux,x64,gpu
-    security_opt:
-      # needed on SELinux systems to allow docker container to manage other docker containers
-      - label:disable
-    volumes:
-      - '/var/run/docker.sock:/var/run/docker.sock'
-      - '/tmp/runner:/tmp/runner'
-      # note: a quirk of docker-in-docker is that this path
-      # needs to be the same path on host and inside the container,
-      # docker mgmt cmds run outside of docker but expect the paths from within
-```
-
-### Nomad ###
-
-```hcl
-job "github_runner" {
-  datacenters = ["home"]
-  type = "system"
-
-  task "runner" {
-    driver = "docker"
-
-    env {
-      ACCESS_TOKEN       = "footoken"
-      RUNNER_NAME_PREFIX = "myrunner"
-      RUNNER_WORKDIR     = "/tmp/github-runner-your-repo"
-      RUNNER_GROUP       = "my-group"
-      RUNNER_SCOPE       = "org"
-      ORG_NAME           = "octokode"
-      LABELS             = "my-label,other-label"
-    }
-
-    config {
-      image = "myoung34/github-runner:latest"
-      
-      privileged  = true
-      userns_mode = "host"
-
-      volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock",
-        "/tmp/github-runner-your-repo:/tmp/github-runner-your-repo",
-      ]
-    }
-  }
-}
-```
-
-### Kubernetes ###
-
-```yml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: actions-runner
-  namespace: runners
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: actions-runner
-  template:
-    metadata:
-      labels:
-        app: actions-runner
-    spec:
-      volumes:
-      - name: dockersock
-        hostPath:
-          path: /var/run/docker.sock
-      - name: workdir
-        hostPath:
-          path: /tmp/github-runner-your-repo
-      containers:
-      - name: runner
-        image: myoung34/github-runner:latest
-        env:
-        - name: ACCESS_TOKEN
-          value: foo-access-token
-        - name: RUNNER_SCOPE
-          value: "org"
-        - name: ORG_NAME
-          value: octokode
-        - name: LABELS
-          value: my-label,other-label
-        - name: RUNNER_TOKEN
-          value: footoken
-        - name: REPO_URL
-          value: https://github.com/your-account/your-repo
-        - name: RUNNER_NAME_PREFIX
-          value: foo
-        - name: RUNNER_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: RUNNER_WORKDIR
-          value: /tmp/github-runner-your-repo
-        - name: RUNNER_GROUP
-          value: my-group
-        volumeMounts:
-        - name: dockersock
-          mountPath: /var/run/docker.sock
-        - name: workdir
-          mountPath: /tmp/github-runner-your-repo
-```
-
-## Usage From GH Actions Workflow ##
-
-```yml
-name: Package
-
-on:
-  release:
-    types: [created]
-
-jobs:
-  build:
-    runs-on: self-hosted
-    steps:
-    - uses: actions/checkout@v1
-    - name: build packages
-      run: make all
-```
-
-## Automatically Acquiring a Runner Token  ##
-
-A runner token can be automatically acquired at runtime if `ACCESS_TOKEN` (a GitHub personal access token) is a supplied. This uses the [GitHub Actions API](https://developer.github.com/v3/actions/self_hosted_runners/#create-a-registration-token). e.g.:
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e RUNNER_SCOPE="org" \
-  -e ORG_NAME="octokode" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-## Create GitHub personal access token  ##
-
-Creating GitHub personal access token (PAT) for using by self-hosted runner make sure the following scopes are selected:
-
-* repo (all)
-* admin:org (all) **_(mandatory for organization-wide runner)_**
-* admin:enterprise (all) **_(mandatory for enterprise-wide runner)_**
-* admin:public_key - read:public_key
-* admin:repo_hook - read:repo_hook
-* admin:org_hook
-* notifications
-* workflow
-
-Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.
-
-## Run a runner on enterprise scope  ##
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e RUNNER_SCOPE="enterprise" \
-  -e ENTERPRISE_NAME="my-enterprise" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-## Ephemeral mode
-
-GitHub's hosted runners are completely ephemeral.  You can remove all its data without breaking all future jobs.
-
-To achieve the same resilience in a self-hosted runner:
-  1. override the command for your runner with `/ephemeral-runner.sh` (which will terminate after one job executes)
-  2. don't mount a local folder into `RUNNER_WORKDIR` (to ensure no filesystem persistence)
-  3. run the container with `--rm` (to delete it after termination)
-  4. wrap the container execution in a system service that restarts (to start a fresh container after each job)
-
-Here's an example service definition for systemd:
-
-```
-# Install with:
-#   sudo install -m 644 ephemeral-github-actions-runner.service /etc/systemd/system/
-#   sudo systemctl daemon-reload
-#   sudo systemctl enable ephemeral-github-actions-runner
-# Run with:
-#   sudo systemctl start ephemeral-github-actions-runner
-# Stop with:
-#   sudo systemctl stop ephemeral-github-actions-runner
-# See live logs with:
-#   journalctl -f -u ephemeral-github-actions-runner.service --no-hostname --no-tail
-
-[Unit]
-Description=Ephemeral GitHub Actions Runner Container
-After=docker.service
-Requires=docker.service
-
-[Service]
-TimeoutStartSec=0
-Restart=always
-ExecStartPre=-/usr/bin/docker stop %n
-ExecStartPre=-/usr/bin/docker rm %n
-ExecStartPre=-/usr/bin/docker pull myoung34/github-runner:latest
-ExecStart=/usr/bin/docker run --rm --env-file /etc/ephemeral-github-actions-runner.env --name %n myoung34/github-runner:latest /ephemeral-runner.sh
-
-[Install]
-WantedBy=multi-user.target
-```
-
-And an example of the corresponding env file that the service reads from:
-
-```
-# Install with:
-#   sudo install -m 600 ephemeral-github-actions-runner.env /etc/
-REPO_URL=https://github.com/your-org/your-repo
-RUNNER_NAME=your-runner-name-here
-ACCESS_TOKEN=foo-access-token
-RUNNER_WORKDIR=/tmp/runner/work
-LABELS=any-custom-labels-go-here
-EPHEMERAL=true
-```
-
-## Proxy Support
-
-To run the github runners behind a proxy, you need to pass the [proxy parameters required for the GitHub Runner](https://docs.github.com/en/actions/hosting-your-own-runners/using-a-proxy-server-with-self-hosted-runners) as environment variables. 
-Note: The `http://` as prefix is required by the GitHub Runner.
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e https_proxy="http://myproxy:3128" \
-  -e http_proxy="http://myproxy:3128" \
-  -e RUNNER_NAME_PREFIX="myrunner" \
-  # ...
-  myoung34/github-runner:latest
+| `DISABLE_AUTO_UPDATE` | Optional environment variable to [disable auto updates](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/). Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |
@@ -25,6 +25,7 @@ _RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
 _LABELS=${LABELS:-default}
 _RUNNER_GROUP=${RUNNER_GROUP:-Default}
 _GITHUB_HOST=${GITHUB_HOST:="github.com"}
+_RUN_AS_ROOT=${RUN_AS_ROOT:="true"}

 # ensure backwards compatibility
 if [[ -z $RUNNER_SCOPE ]]; then
@@ -72,6 +73,13 @@ configure_runner() {
    _EPHEMERAL=""
  fi

+  if [ -n "${DISABLE_AUTO_UPDATE}" ]; then
+    echo "Disable auto update option is enabled"
+    _AUTO_UPDATE="--disableupdate"
+  else
+    _AUTO_UPDATE=""
+  fi
+
  echo "Configuring"
  ./config.sh \
      --url "${_SHORT_URL}" \
@@ -81,7 +89,13 @@ configure_runner() {
      --labels "${_LABELS}" \
      --runnergroup "${_RUNNER_GROUP}" \
      --unattended \
-      --replace ${_EPHEMERAL}
+      --replace \
+      ${_EPHEMERAL} \
+      ${_AUTO_UPDATE}
+
+  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
+
+  [[ $(id -u) -eq 0 ]] && /usr/bin/chown -R runner ${_RUNNER_WORKDIR} /opt/hostedtoolcache/ /actions-runner || :
 }


@@ -115,5 +129,20 @@ if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
  trap deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
 fi

-# Container's command (CMD) execution
-"$@"
+# Container's command (CMD) execution as runner user
+
+
+if [[ ${_RUN_AS_ROOT} == "true" ]]; then
+  if [[ $(id -u) -eq 0 ]]; then
+    "$@"
+  else
+    echo "ERROR: RUN_AS_ROOT env var is set to true but the user has been overridden and is not running as root, but UID '$(id -u)'"
+    exit 1
+  fi
+else
+  if [[ $(id -u) -eq 0 ]]; then
+    /usr/sbin/gosu runner "$@"
+  else
+    "$@"
+  fi
+fi
@@ -1,36 +0,0 @@
-#!/bin/bash
-
-echo "*** Starting ephemeral runner. ***"
-/actions-runner/run.sh --ephemeral
-rv=$?
-
-# See exit code constants in the runner source here:
-# https://github.com/actions/runner/blob/be96323/src/Runner.Common/Constants.cs#L135
-if [[ $rv == 4 ]]; then
-  # The runner software was updated.
-  echo "*** Software update detected. ***"
-
-  echo "*** Waiting for update to complete. ***"
-  # Hard-coded sleep.  Without some delay, the update is still in progress in
-  # the background, leading to failures when we re-launch.
-  sleep 10
-
-  # Now add an adaptive delay, where we loop and check if the Runner is usable
-  # yet.  As soon as it is, break.
-  for i in $(seq 10); do
-    if /actions-runner/bin/Runner.Listener --version &>/dev/null; then
-      break
-    fi
-
-    echo "*** Update still in progress... ***"
-    sleep 5
-  done
-
-  # Now re-launch the script.
-  echo "*** Re-launching runner. ***"
-  exec "$0"
-fi
-
-# For any other return value, let the script and the Docker container terminate.
-echo "*** Exit code $rv ***"
-exit $rv
@@ -3,9 +3,7 @@ GH_RUNNER_VERSION=$1
 TARGETPLATFORM=$2

 export TARGET_ARCH="x64"
-if [[ $TARGETPLATFORM == "linux/arm/v7" ]]; then
-  export TARGET_ARCH="arm"
-elif [[ $TARGETPLATFORM == "linux/arm64" ]]; then
+if [[ $TARGETPLATFORM == "linux/arm64" ]]; then
  export TARGET_ARCH="arm64"
 fi
 curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/actions-runner-linux-${TARGET_ARCH}-${GH_RUNNER_VERSION}.tar.gz" > actions.tar.gz
Author	SHA1	Message	Date
Marcus Young	a6a57d36ab	[Automated 🤖 ] Bump to version 2.296.2	2022-09-08 12:46:35 -05:00
myoung34andGitHub	de41bc7f8b	Merge pull request #234 from Rumbles/master Check to see if not running as root	2022-09-06 19:41:53 -05:00
myoung34andGitHub	c253d823a6	Merge pull request #238 from nmalaguti/feature/github-cli-gpg-key-problem Change gh cli install method to github releases	2022-09-06 19:24:04 -05:00
Nick Malaguti	214b75489b	Change gh cli install method to github releases The apt repo for the gh cli is broken due to an expired GPG key: https://github.com/cli/cli/issues/6175 They want to retire the debian packaging altogether https://github.com/cli/cli/issues/5941 and this is the recommended "long term" solution https://github.com/cli/cli/issues/6175#issuecomment-1235984381. Adapted from https://github.com/cli/cli/issues/6175#issuecomment-1236264607 Fixes #236	2022-09-06 09:59:23 -04:00
James Stocker	2cffdf6b9a	Update logic at the end as requested	2022-09-02 12:26:29 +02:00
James Stocker GitHub myoung34	a779a7f993	Update entrypoint.sh Co-authored-by: myoung34 <myoung34@my.apsu.edu>	2022-09-02 12:23:31 +02:00
James Stocker GitHub myoung34	217117d3bc	Update entrypoint.sh Co-authored-by: myoung34 <myoung34@my.apsu.edu>	2022-09-02 12:23:22 +02:00
James Stocker GitHub myoung34	829c6ccd91	Update entrypoint.sh Co-authored-by: myoung34 <myoung34@my.apsu.edu>	2022-09-02 12:23:16 +02:00
James Stocker GitHub myoung34	d414c3a388	Update entrypoint.sh Co-authored-by: myoung34 <myoung34@my.apsu.edu>	2022-09-02 12:22:36 +02:00
Marcus Young	28cb729624	[Automated 🤖 ] Bump to version 2.296.1	2022-08-31 12:45:45 -05:00
James Stocker	733ff44be5	Check to see if not running as root Change logic slightly avoid edge case	2022-08-30 10:22:25 +02:00
myoung34andGitHub	0f9d476978	Merge pull request #179 from jarrett-confrey/feat/add-gh-cli feat: add github cli (gh)	2022-08-29 13:43:48 -05:00
jarrett-confrey	6d189b3bae	feat: add github cli (gh)	2022-08-29 11:04:46 -07:00
Marcus Young	36d8efe0c3	[Automated 🤖 ] Bump to version 2.296.0	2022-08-23 09:57:53 -05:00
myoung34andGitHub	9afc3108fc	Merge pull request #231 from nikeee/master Add git-lfs to base image	2022-08-17 09:27:15 -05:00
Niklas Mollenhauer GitHub myoung34	cc396abd59	Update Dockerfile.base Co-authored-by: myoung34 <myoung34@my.apsu.edu>	2022-08-17 16:19:18 +02:00
Niklas MollenhauerandGitHub	e8ff100cc0	Add git-lfs to base image Using the checkout action with `lfs: true` currently fails with the error: ``` Unable to locate executable file: git-lfs. ``` See: https://git-lfs.github.com	2022-08-17 13:54:58 +02:00
Marcus Young	3d2c69648f	[Automated 🤖 ] Bump to version 2.295.0	2022-08-10 09:54:08 -05:00
Marcus Young	bc2c03d8c9	Dont run as non-root by default	2022-08-01 16:52:32 -05:00
myoung34andGitHub	51125e863e	Merge pull request #226 from marcus-bcl/patch-1 Set ownership of /opt/hostedtoolcache	2022-07-27 09:47:23 -05:00
Marcus AspinandGitHub	18afadab14	Set ownership of /opt/hostedtoolcache	2022-07-27 15:45:02 +01:00
Marcus Young	ab8b9d7e6b	Fix sudoers for runner user	2022-07-27 07:53:48 -05:00
Marcus Young	b9622cc4e7	Last changes for run-as runner user	2022-07-26 12:07:03 -05:00
myoung34andGitHub	62a7a5f10c	Merge pull request #223 from marcus-bcl/master Run as non-root user by default	2022-07-26 11:47:59 -05:00
Marcus AspinandGitHub	36f4ed430a	Merge pull request #1 from myoung34/user_fixes Swap USER directive for gosu for runtime permissions	2022-07-26 16:31:32 +01:00
Marcus Young	a257b7ad38	Guarantee base dirs for -u runner	2022-07-26 10:27:48 -05:00
Marcus Young	ba8c7f86a9	Move user add to docker base	2022-07-26 09:55:51 -05:00
Marcus Young	cda2ba1fb4	Swap USER directive for gosu for runtime permissions	2022-07-26 09:44:02 -05:00
Marcus Aspin	8d4afae3d2	Move entrypoint after user-creation	2022-07-26 08:20:40 +01:00
myoung34andGitHub	96aaa5c17c	Merge pull request #224 from Uzlopak/remove-awscliv2.zip remove awscliv2.zip after unzipping	2022-07-25 12:25:43 -05:00
uzlopak	5e529f979a	remove awscliv2.zip after unzipping	2022-07-25 10:59:53 +02:00
Marcus Aspin	f6da106489	Add runner user to group 121, and mark as system user	2022-07-25 09:23:30 +01:00
Marcus Aspin	d2a3df72e6	Run as non-root user by default	2022-07-22 15:05:33 +01:00
Marcus Young	133c12574c	Remove temporary workaround for liblttng-ust0/1 https://github.com/actions/runner/issues/1584	2022-06-22 11:31:46 -05:00
Marcus Young	e376daf19c	[Automated 🤖 ] Bump to version 2.294.0	2022-06-22 11:15:15 -05:00
myoung34andGitHub	e729e6c6d4	Update README.md	2022-06-16 20:32:28 -05:00
Marcus Young	4064635fcd	Restore latest to focal vs jammy	2022-06-16 16:23:42 -05:00
Marcus Young	11c9fcc196	[Automated 🤖 ] Bump to version 2.293.0	2022-06-10 09:03:27 -05:00
myoung34andGitHub	1807dca61a	Merge pull request #214 from myoung34/rsync add rsync	2022-06-07 21:11:57 -05:00
Marcus Young	d4b0627097	add rsync	2022-06-07 21:10:58 -05:00
Marcus Young	12756a2db9	Fix double quotes for ORG interpolation	2022-06-07 19:59:28 -05:00
Marcus Young	6d52ecde6d	Fix README	2022-06-07 19:36:20 -05:00
Marcus Young	b62b07ddc7	Purge armv7, fix ubuntu matrix	2022-06-07 19:29:23 -05:00
myoung34andGitHub	648a8193a9	Merge pull request #213 from myoung34/wiki refactor workflows, start moving to wiki	2022-06-07 17:25:59 -05:00
Marcus Young	597c9c5a89	refactor workflows, start moving to wiki	2022-06-07 16:49:25 -05:00
myoung34andGitHub	86c4382bd7	Merge pull request #211 from Ru13en/master Upgrade docker image to latest LTS version (jammy)	2022-06-07 15:41:01 -05:00
Ruben RodriguesandGitHub	2ae9b3723e	Update Dockerfile.base	2022-06-07 03:13:04 +01:00
Ruben RodriguesandGitHub	e009ebcfc4	Update Dockerfile.base	2022-06-07 03:07:40 +01:00
Ruben RodriguesandGitHub	cb37a448df	Merge branch 'master' into master	2022-06-07 02:25:19 +01:00
Ruben RodriguesandRuben Rodrigues	60a36401e8	Upgrade docker image to latest LTS version (jammy)	2022-06-07 02:16:10 +01:00
myoung34andGitHub	3bb009e315	Merge pull request #210 from Ru13en/master Add support for buildah-build and podman-push actions	2022-06-02 15:46:04 -04:00
Ruben RodriguesandGitHub	faac4c020d	Add missing buildah and skopeo	2022-06-02 20:22:56 +01:00
Ruben RodriguesandGitHub	1772a92395	Add podman/buildah/skopeo to base image	2022-06-02 20:15:19 +01:00
Marcus Young	0479f7d7b1	[Automated 🤖 ] Bump to version 2.292.0	2022-05-23 10:26:37 -05:00
myoung34andGitHub	fe55a59385	Merge pull request #207 from joeyparrish/ephemeral2 fix: Simplify ephemeral runner setup	2022-05-10 19:32:39 -05:00
Joey Parrish	dd69bd9dcc	fix: Simplify ephemeral runner setup The entrypoint script ephemeral-runner.sh is no longer required. This removes the script and updates the docs with a simpler recommended setup. This is the same setup my team is using in our lab at Google on 6 different hosts.	2022-05-10 13:10:33 -07:00
Marcus Young	7f896c8f56	[Automated 🤖 ] Bump to version 2.291.1	2022-04-29 10:03:20 -05:00
Marcus Young	566dd9110c	[Automated 🤖 ] Bump to version 2.291.0	2022-04-29 07:01:05 -05:00
myoung34andGitHub	aa7d3b39e3	Update README.md	2022-04-27 12:36:27 -05:00
Marcus Young	751e6dfae4	Revert back to 2.290.1	2022-04-20 17:56:11 -05:00
Marcus Young	5eb3642bd3	[Automated 🤖 ] Bump to version 2.289.3	2022-04-19 15:38:15 -05:00
myoung34andGitHub	bfab79fc5d	Update README.md	2022-04-18 15:11:54 -05:00
myoung34andGitHub	528dfd3b2d	Merge pull request #202 from myoung34/hotfix/deregestration Fix de-registration	2022-04-18 09:49:54 -05:00
Marcus Young	95cd8d9835	Fix de-registration	2022-04-18 09:49:38 -05:00
Marcus Young	825fa07289	[Automated 🤖 ] Bump to version 2.290.1	2022-04-14 09:50:16 -05:00
myoung34andGitHub	8c2635fb48	Merge pull request #200 from Firefishy/fix-ga-build-issue Fix github action environment handling	2022-04-14 07:26:17 -05:00
Grant Slater	f3ce751087	Fix github action environment handling	2022-04-14 13:24:49 +01:00
myoung34andGitHub	501dffaa90	Merge pull request #194 from Firefishy/upgrade-github-actions Clean-up github actions to use official actions	2022-04-14 06:58:48 -05:00
Marcus Young	04145dad12	[Automated 🤖 ] Bump to version 2.290.0	2022-04-12 10:04:32 -05:00
myoung34andGitHub	744edabaa2	Merge pull request #195 from myoung34/fix_auto_update Fix disable auto update	2022-04-01 21:55:00 -05:00
Marcus Young	8604248edf	Fix disable auto update	2022-04-01 21:54:08 -05:00
Marcus Young	5727df6463	[Automated 🤖 ] Bump to version 2.289.2	2022-03-30 09:38:48 -05:00
Grant Slater	500dae91a3	Clean-up github actions to use official actions	2022-03-23 22:03:15 +00:00
Marcus Young	9a4c9687b6	[Automated 🤖 ] Bump to version 2.289.1	2022-03-18 13:48:30 -05:00
Marcus Young	22da74a53e	[Automated 🤖 ] Bump to version 2.289.0	2022-03-18 10:44:08 -05:00
Marcus Young	eba879f8a8	[Automated 🤖 ] Bump to version 2.288.1	2022-02-28 13:18:07 -06:00
Marcus Young	5aa59da8ca	[Automated 🤖 ] Bump to version 2.288.0	2022-02-28 13:17:39 -06:00
myoung34andGitHub	742cae3439	Update README.md	2022-02-23 21:24:40 -06:00
myoung34andGitHub	f85e5be0ba	Merge pull request #189 from ikari7789/patch-1 Add proxy env variable passthru on sudo	2022-02-17 19:49:09 -06:00
Andrew Miller	bb4285357f	Use `.*` instead of ' ' for find/replace in sudoers	2022-02-18 10:23:10 +09:00
Andrew MillerandAndrew Miller	9828ae64b1	Add proxy env variable passthru on sudo If you use "sudo" in the workflow file while behind a proxy, the environment variables passed into the container on creation will be lost since sudo current resets the environment. Update /etc/sudoers to allow the _proxy and _PROXY variables to be passed thru so proxy configuration is not lost.	2022-02-17 13:34:45 +09:00
myoung34andGitHub	ff360e9b08	Merge pull request #184 from myoung34/disable_auto_updates Add DISABLE_AUTO_UPDATE flag to disable automatic updates	2022-02-03 09:31:22 -06:00
Marcus Young	89fd82e9f8	Add DISABLE_AUTO_UPDATE flag to disable automatic updates	2022-02-03 09:30:51 -06:00
Marcus Young	3ea2681c1c	Add missing dependency for awscli fallback	2022-02-01 20:18:06 -06:00
myoung34andGitHub	a3b283960b	Merge pull request #183 from myoung34/fix_awscli Fix awscli to have a fallback method	2022-02-01 17:29:22 -06:00
Marcus Young	2c8611c5b0	Fix awscli to have a fallback method	2022-02-01 16:51:34 -06:00
myoung34andGitHub	783f219932	Merge pull request #180 from MrKevinWeiss/pr/fix/readmesystemd fix(README.md): Fix the service example	2022-01-30 21:22:17 -06:00
myoung34andGitHub	ba2f46a524	Merge pull request #182 from wildone/master Update readme	2022-01-30 21:14:58 -06:00
Max BarrassandGitHub	7dae856b52	Update README.md	2022-01-31 12:55:36 +11:00
Max BarrassandGitHub	bbac066934	Update README.md	2022-01-31 12:54:09 +11:00
Marcus Young	75e6e523a6	[Automated 🤖 ] Bump to version 2.287.1	2022-01-27 15:28:54 -06:00
Kevin "Tristate Tom" WeissandGitHub	7881135a1a	fix(README.md): Fix the service example I was able to get everything up and running and it looks good aside from a small gotcha. While setting up an ephemeral systemd service it seemed that I still needed to mount the `/var/run/docker.sock`. I am a pretty big fan of copy pasta and this may save a few google queries for "cannot connect to the docker daemon at unix:///var/run/docker.sock. is the docker daemon running?" I guess some issue with docker in docker. Anyways, just wondering if it would be useful, no need to merge if it doesn't make sense.	2022-01-27 20:41:36 +01:00