[Automated 🤖 ] Bump to version 2.299.1

Fix ephemeral support

.github/workflows/base.yml

@@ -17,7 +17,7 @@ jobs:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
@@ -39,19 +39,23 @@ jobs:
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  ubuntu_base_bionic_deploy:
+  ubuntu_base_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
     steps:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
       - name: Copy Dockerfile
-        run: cp Dockerfile.base Dockerfile.base.ubuntu-bionic; sed -i.bak 's/FROM.*/FROM ubuntu:bionic/' Dockerfile.base.ubuntu-bionic
+        run: cp Dockerfile.base Dockerfile.base.ubuntu-${{ matrix.release }}; sed -i.bak 's/FROM.*/FROM ubuntu:${{ matrix.release }}/' Dockerfile.base.ubuntu-${{ matrix.release }}
       - name: Login to DockerHub
         uses: docker/login-action@v1
         with:
@@ -61,11 +65,11 @@ jobs:
         uses: docker/build-push-action@v2
         with:
           context: .
-          file: Dockerfile.base.ubuntu-bionic
+          file: Dockerfile.base.ubuntu-${{ matrix.release }}
           pull: true
           push: true
-          tags: ${{ env.ORG }}/github-runner-base:ubuntu-bionic
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          tags: ${{ env.ORG }}/github-runner-base:ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -79,7 +83,7 @@ jobs:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
@@ -99,6 +103,6 @@ jobs:
           pull: true
           push: true
           tags: ${{ env.ORG }}/github-runner-base:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/deploy.yml

@@ -10,6 +10,10 @@ on:
   schedule:
     - cron:  '59 23 * * *'
 
+permissions: 
+  contents: read
+  packages: write 
+
 jobs:
   ubuntu_latest_deploy:
     runs-on: ubuntu-latest
@@ -17,16 +21,24 @@ jobs:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
+      - name: Update Dockerfile FROM org
+        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         uses: docker/build-push-action@v2
         with:
@@ -34,38 +46,48 @@ jobs:
           file: Dockerfile
           pull: true
           push: true
-          tags: ${{ env.ORG }}/github-runner:latest
+          tags: ${{ env.ORG }}/github-runner:latest,ghcr.io/${{ github.repository }}:latest
           platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  ubuntu_bionic_deploy:
+  ubuntu_deploy:
     runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
     steps:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
       - name: Copy Dockerfile
-        run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         uses: docker/build-push-action@v2
         with:
           context: .
-          file: Dockerfile.ubuntu-bionic
+          file: Dockerfile.ubuntu-${{ matrix.release }}
           pull: true
           push: true
-          tags: ${{env.ORG}}/github-runner:ubuntu-bionic
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          tags: ${{env.ORG}}/github-runner:ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -79,7 +101,7 @@ jobs:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
@@ -87,10 +109,16 @@ jobs:
       - name: Copy Dockerfile
         run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         uses: docker/build-push-action@v2
         with:
@@ -98,7 +126,7 @@ jobs:
           file: Dockerfile.debian-${{ matrix.release }}
           pull: true
           push: true
-          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          tags: ${{ env.ORG }}/github-runner:debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max

.github/workflows/release.yml

@@ -4,6 +4,10 @@ on:
     tags:
       - '*'
 
+permissions:
+  contents: write
+  packages: write
+
 jobs:
   create-release:
     name: Create Release
@@ -21,6 +25,7 @@ jobs:
         release_name: Release ${{ github.ref }}
         draft: false
         prerelease: false
+
   ubuntu_latest_tag:
     runs-on: ubuntu-latest
     needs: create-release
@@ -30,16 +35,24 @@ jobs:
       - name: get version
         run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
+      - name: Update Dockerfile FROM org
+        run: sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:latest/" Dockerfile
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         uses: docker/build-push-action@v2
         with:
@@ -47,43 +60,51 @@ jobs:
           file: Dockerfile
           pull: true
           push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }},ghcr.io/${{ github.repository }}:${{ env.TAG }}
           platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
-  ubuntu_bionic_tag:
+  ubuntu_tag:
     runs-on: ubuntu-latest
     needs: create-release
+    strategy:
+      matrix:
+        release: [jammy, focal, bionic]
+      fail-fast: false
     steps:
       - name: Copy Repo Files
         uses: actions/checkout@master
       - name: get version
         run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
         uses: docker/setup-buildx-action@v1
-      - name: Available platforms
-        run: echo ${{ steps.buildx.outputs.platforms }}
       - name: Copy Dockerfile
-        run: cp Dockerfile Dockerfile.ubuntu-bionic; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-bionic/" Dockerfile.ubuntu-bionic
+        run: cp Dockerfile Dockerfile.ubuntu-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:ubuntu-${{ matrix.release }}/" Dockerfile.ubuntu-${{ matrix.release }}
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         uses: docker/build-push-action@v2
         with:
           context: .
-          file: Dockerfile.ubuntu-bionic
+          file: Dockerfile.ubuntu-${{ matrix.release }}
           pull: true
           push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-bionic
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-ubuntu-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-ubuntu-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
           cache-to: type=gha,mode=max
 
@@ -100,7 +121,7 @@ jobs:
       - name: get version
         run: echo 'TAG='${GITHUB_REF#refs/tags/} >> $GITHUB_ENV
       - name: Get GitHub organization or user
-        run: echo 'ORG='$(dirname ${GITHUB_REPOSITORY}) >> $GITHUB_ENV
+        run: echo 'ORG='$(echo $(dirname ${GITHUB_REPOSITORY}) | awk '{print tolower($0)}') >> $GITHUB_ENV
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v1
       - name: Set up Docker Buildx
@@ -108,10 +129,16 @@ jobs:
       - name: Copy Dockerfile
         run: cp Dockerfile Dockerfile.debian-${{ matrix.release }}; sed -i.bak "s/FROM.*/FROM ${ORG}\/github-runner-base:debian-${{ matrix.release }}/" Dockerfile.debian-${{ matrix.release }}
       - name: Login to DockerHub
-        uses: docker/login-action@v1
+        uses: docker/login-action@v2
         with:
           username: ${{ secrets.DOCKER_USER }}
           password: ${{ secrets.DOCKER_TOKEN }}
+      - name: Login to GitHub Container Registry
+        uses: docker/login-action@v2
+        with:
+          registry: ghcr.io
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
       - name: Build and push
         uses: docker/build-push-action@v2
         with:
@@ -119,7 +146,7 @@ jobs:
           file: Dockerfile.debian-${{ matrix.release }}
           pull: true
           push: true
-          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }}
-          platforms: linux/amd64,linux/arm64,linux/arm/v7
+          tags: ${{ env.ORG }}/github-runner:${{ env.TAG }}-debian-${{ matrix.release }},ghcr.io/${{ github.repository }}:${{ env.TAG }}-debian-${{ matrix.release }}
+          platforms: linux/amd64,linux/arm64
           cache-from: type=gha
-          cache-to: type=gha,mode=max
+          cache-to: type=gha,mode=max

.github/workflows/test.yml

@@ -0,0 +1,15 @@
+on:
+  pull_request:
+
+name: "Trigger: Push action"
+
+jobs:
+  tests:
+    name: Tests
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - uses: actions/setup-python@v3
+      - uses: pre-commit/action@v3.0.0
+      - name: Run ShellCheck
+        uses: ludeeus/action-shellcheck@master

.pre-commit-config.yaml

@@ -1,9 +1,13 @@
 repos:
-- repo: git://github.com/detailyang/pre-commit-shell
-  rev: 1.0.2
+- repo: https://github.com/pre-commit/pre-commit-hooks
+  rev: v4.3.0
   hooks:
-  - id: shell-lint
-    args: [-e, SC1008]
+  - id: check-yaml
+  - id: end-of-file-fixer
+  - id: trailing-whitespace
+  - id: check-case-conflict
+  - id: check-merge-conflict
+  - id: detect-private-key
 - repo: https://github.com/stratasan/hadolint-pre-commit
   rev: cdefcb096e520a6daa9552b1d4636f5f1e1729cd
   hooks:

CHANGELOG.md

@@ -1,3 +0,0 @@
-6/3/2021 (latest)
-
- * `ORG_RUNNER` is now deprecated in favor of `RUNNER_SCOPE`. If you are currently using `ORG_RUNNER` please drop that in favor of `RUNNER_SCOPE="org"`

CONTRIBUTING.md

@@ -0,0 +1,17 @@
+# Welcome to docker-github-actions-runner contributing guide <!-- omit in toc -->
+
+Welcome!
+
+## Code of conduct
+
+Be kind, research before asking/contributing.
+
+Please remember that my time is limited and my resources are as well. Solving "nuances" will likely require external contributions but I'm happy to help and guide.
+
+### Issues
+
+#### Create a new issue
+
+If you spot an issue, [search if an issue already exists](https://docs.github.com/en/github/searching-for-information-on-github/searching-on-github/searching-issues-and-pull-requests#search-by-the-title-body-or-comments). If a related issue doesn't exist, you can open a new issue using a relevant issue.
+
+Also use [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki) and contribute to it

Dockerfile

@@ -5,7 +5,7 @@ LABEL maintainer="myoung34@my.apsu.edu"
 ENV AGENT_TOOLSDIRECTORY=/opt/hostedtoolcache
 RUN mkdir -p /opt/hostedtoolcache
 
-ARG GH_RUNNER_VERSION="2.291.0"
+ARG GH_RUNNER_VERSION="2.299.1"
 ARG TARGETPLATFORM
 
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
@@ -13,15 +13,13 @@ SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 WORKDIR /actions-runner
 COPY install_actions.sh /actions-runner
 
-# TODO: remove this terrible sed once
-#  https://github.com/actions/runner/pull/1585 is merged or similar
 RUN chmod +x /actions-runner/install_actions.sh \
-  && sed -i.bak 's/.\/bin\/installdependencies.sh/wget https:\/\/raw.githubusercontent.com\/myoung34\/runner\/main\/src\/Misc\/layoutbin\/installdependencies.sh -O .\/bin\/installdependencies.sh; bash .\/bin\/installdependencies.sh/g' /actions-runner/install_actions.sh \
   && /actions-runner/install_actions.sh ${GH_RUNNER_VERSION} ${TARGETPLATFORM} \
-  && rm /actions-runner/install_actions.sh
+  && rm /actions-runner/install_actions.sh \
+  && chown runner /_work /actions-runner /opt/hostedtoolcache
 
-COPY token.sh entrypoint.sh ephemeral-runner.sh /
-RUN chmod +x /token.sh /entrypoint.sh /ephemeral-runner.sh
+COPY token.sh entrypoint.sh /
+RUN chmod +x /token.sh /entrypoint.sh
 
 ENTRYPOINT ["/entrypoint.sh"]
 CMD ["./bin/Runner.Listener", "run", "--startuptype", "service"]

Dockerfile.base

@@ -3,21 +3,23 @@ LABEL maintainer="myoung34@my.apsu.edu"
 
 ARG DUMB_INIT_VERSION="1.2.2"
 ARG GIT_CORE_PPA_KEY="A1715D88E1DF1F24"
-ARG DOCKER_KEY="7EA0A9C3F273FCD8"
 
 ENV DOCKER_COMPOSE_VERSION="1.27.4"
+ENV GIT_LFS_VERSION="3.2.0"
 ENV LANG=en_US.UTF-8
 ENV LANGUAGE=en_US.UTF-8
 ENV LC_ALL=en_US.UTF-8
 SHELL ["/bin/bash", "-o", "pipefail", "-c"]
 ENV DEBIAN_FRONTEND=noninteractive
-# hadolint ignore=DL3003,DL4001,SC2086
+# hadolint ignore=SC2086,DL3015,DL3008,DL3013
 RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
   && apt-get update \
   && apt-get install -y --no-install-recommends gnupg \
   && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${GIT_CORE_PPA_KEY} \
   && apt-get update \
   && apt-get install -y --no-install-recommends \
+    gnupg \
+    lsb-release \
     curl \
     tar \
     unzip \
@@ -41,23 +43,37 @@ RUN echo en_US.UTF-8 UTF-8 >> /etc/locale.gen \
     python3-setuptools \
     python3 \
     dumb-init \
+    nodejs \
+    rsync \
+    gosu \
+  && DPKG_ARCH="$(dpkg --print-architecture)" \
+  && LSB_RELEASE_CODENAME="$(lsb_release --codename | cut -f2)" \
   && sed -e 's/Defaults.*env_reset/Defaults env_keep = "HTTP_PROXY HTTPS_PROXY NO_PROXY FTP_PROXY http_proxy https_proxy no_proxy ftp_proxy"/' -i /etc/sudoers \
   && echo deb http://ppa.launchpad.net/git-core/ppa/ubuntu $([[ $(grep -E '^ID=' /etc/os-release | sed 's/.*=//g') == "ubuntu" ]] && (grep VERSION_CODENAME /etc/os-release | sed 's/.*=//g') || echo bionic) main>/etc/apt/sources.list.d/git-core.list \
   && apt-get update \
   && ( apt-get install -y --no-install-recommends git || apt-get install -t stable -y --no-install-recommends git || apt-get install -y --no-install-recommends git=1:2.33.1-0ppa1~ubuntu18.04.1 git-man=1:2.33.1-0ppa1~ubuntu18.04.1 ) \
   && ( [[ $(apt-cache search -n liblttng-ust0 | awk '{print $1}') == "liblttng-ust0" ]] && apt-get install -y --no-install-recommends liblttng-ust0 || : ) \
   && ( [[ $(apt-cache search -n liblttng-ust1 | awk '{print $1}') == "liblttng-ust1" ]] && apt-get install -y --no-install-recommends liblttng-ust1 || : ) \
-  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install ) || pip3 install awscli ) \
-  # Determine the Distro name (Debian, Ubuntu, etc)
+  && ( ( curl "https://awscli.amazonaws.com/awscli-exe-linux-$(uname -m).zip" -o "awscliv2.zip" && unzip awscliv2.zip -d /tmp/ && /tmp/aws/install && rm awscliv2.zip) || pip3 install --no-cache-dir awscli ) \
+  && ( curl -s "https://github.com/git-lfs/git-lfs/releases/download/v${GIT_LFS_VERSION}/git-lfs-linux-${DPKG_ARCH}-v${GIT_LFS_VERSION}.tar.gz" -L -o /tmp/lfs.tar.gz && tar -xzf /tmp/lfs.tar.gz -C /tmp && /tmp/git-lfs-${GIT_LFS_VERSION}/install.sh && rm -rf /tmp/lfs.tar.gz  /tmp/git-lfs-${GIT_LFS_VERSION}) \
   && distro=$(lsb_release -is | awk '{print tolower($0)}') \
-  # Determine the Distro version (bullseye, xenial, etc)
-  # Note: sid is aliased to bullseye, because Docker doesn't have a matching apt repo
-  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys ${DOCKER_KEY} \
-  && curl -fsSL https://download.docker.com/linux/${distro}/gpg | apt-key add - \
-  && version=$(lsb_release -cs | awk '{gsub("sid", "bullseye"); print $0}') \
-  && ( add-apt-repository "deb [arch=$(dpkg --print-architecture)] https://download.docker.com/linux/${distro} ${version} stable" ) \
+  && mkdir -p /etc/apt/keyrings \
+  && ( curl -fsSL https://download.docker.com/linux/${distro}/gpg | gpg --dearmor -o /etc/apt/keyrings/docker.gpg ) \
+  && version=$(lsb_release -cs | sed 's/bookworm\|n\/a/bullseye/g') \
+  && ( echo "deb [arch=${DPKG_ARCH} signed-by=/etc/apt/keyrings/docker.gpg] https://download.docker.com/linux/${distro} ${version} stable" | tee /etc/apt/sources.list.d/docker.list > /dev/null ) \
   && apt-get update \
   && apt-get install -y docker-ce docker-ce-cli containerd.io --no-install-recommends --allow-unauthenticated \
-  && [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) \
+  && ( [[ $(lscpu -J | jq -r '.lscpu[] | select(.field == "Vendor ID:") | .data') == "ARM" ]] && echo "Not installing docker-compose. See https://github.com/docker/compose/issues/6831" || ( curl -sL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose && chmod +x /usr/local/bin/docker-compose ) ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" ]] && ( echo "deb https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/ /" | tee /etc/apt/sources.list.d/devel:kubic:libcontainers:stable.list && curl -L "https://download.opensuse.org/repositories/devel:/kubic:/libcontainers:/stable/xUbuntu_20.04/Release.key" | apt-key add - && apt-get update) || : ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "focal" || "${LSB_RELEASE_CODENAME}" == "jammy" || "${LSB_RELEASE_CODENAME}" == "sid" || "${LSB_RELEASE_CODENAME}" == "bullseye" ]] && apt-get install -y --no-install-recommends podman buildah skopeo || : ) \
+  && ( [[ "${LSB_RELEASE_CODENAME}" == "jammy" ]] && echo "Ubuntu Jammy is marked as beta. Please see https://github.com/actions/virtual-environments/issues/5490" || : ) \
+  && GH_CLI_VERSION=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq -r '.tag_name' | sed 's/^v//g') \
+  && GH_CLI_DOWNLOAD_URL=$(curl -sL -H "Accept: application/vnd.github+json"   https://api.github.com/repos/cli/cli/releases/latest | jq ".assets[] | select(.name == \"gh_${GH_CLI_VERSION}_linux_${DPKG_ARCH}.deb\")" | jq -r '.browser_download_url') \
+  && curl -sSLo /tmp/ghcli.deb ${GH_CLI_DOWNLOAD_URL} && apt-get -y install /tmp/ghcli.deb && rm /tmp/ghcli.deb \
   && rm -rf /var/lib/apt/lists/* \
-  && rm -rf /tmp/*
+  && rm -rf /tmp/* \
+  && groupadd -g 121 runner \
+  && useradd -mr -d /home/runner -u 1001 -g 121 runner \
+  && usermod -aG sudo runner \
+  && usermod -aG docker runner \
+  && echo '%sudo ALL=(ALL) NOPASSWD: ALL' >> /etc/sudoers

README.md

@@ -5,12 +5,10 @@ Docker Github Actions Runner
 
 This will run the [new self-hosted github actions runners](https://help.github.com/en/actions/automating-your-workflow-with-github-actions/hosting-your-own-runners).
 
-## Quick start for self-hosted runners for Organisations
+## Quick-Start (Examples and Usage) ##
 
-1. Make sure you have a `self-hosted` group in your org. Create or rename default in `https://github.com/organizations/<your org>/settings/actions/runner-groups`.
-2. Create PAT for account that will have access to the org in settings https://github.com/settings/tokens
-3. Create a directory `/tmp/github-runner-your-repo` on the docker host and run [Manual Org Runner](#manual-org-runner), change dir if you want perm location. 
-4. Check docker logs to ensure runner has connected.
+Please see [the wiki](https://github.com/myoung34/docker-github-actions-runner/wiki/Usage)
+Please read [the contributing guidelines](https://github.com/myoung34/docker-github-actions-runner/blob/master/CONTRIBUTING.md)
 
 ## Notes ##
 
@@ -42,12 +40,12 @@ A workaround exists, please see [here](https://github.com/myoung34/docker-github
 
 | Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
 | --- | --- | --- | --- | --- | --- |
-| ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` | [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. | Tags without an OS name *before* 9/17/2020 are `eoan`. `armv7` support stopped 9/18/2020 due to inconsistent docker-ce packaging |
-| ubuntu bionic | `x86_64`,`armv7`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
-| debian buster (now deprecated) | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Buster is Debians current old-stable release. |
-| debian bullseye | `x86_64`,`arm64`,`armv7` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Bullseye is Debians current stable release. |
-| debian sid | `x86_64`,`arm64`,`admv7` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | Sid is considered unstable by Debian. |
-| ubuntu xenial | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-ubuntu-xenial/` | [ubuntu-xenial](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-xenial) | This is the latest build from xenial (Rebuilt nightly and on master merges). Tags with `-ubuntu-xenial` are included and created on [upstream tags](https://github.com/actions/runner/tags). | This is deprecated as of 7/15/2021 and will no longer receive tags. |
+| ubuntu focal | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+/` `/\d\.\d{3}\.\d+-ubuntu-focal/`| [latest](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=latest) [ubuntu-focal](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-focal) | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with `-ubuntu-focal` are included and created on [upstream tags](https://github.com/actions/runner/tags).|
+| ubuntu jammy | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-jammy/` | [ubuntu-jammy](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-jammy) | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with `-ubuntu-jammy` are included and created on [upstream tags](https://github.com/actions/runner/tags). | There is [currently an issue with jammy from inside a 20.04LTS host](https://github.com/myoung34/docker-github-actions-runner/issues/219) which is why this is not `latest` |
+| ubuntu bionic | `x86_64`,`arm64` | `/\d\.\d{3}\.\d+-ubuntu-bionic/` | [ubuntu-bionic](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=ubuntu-bionic) | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with `-ubuntu-bionic` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian buster (now deprecated) | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-buster/` | [debian-buster](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-buster) | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with `-debian-buster` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian bullseye | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-bullseye/` | [debian-bullseye](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-bullseye) | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with `-debian-bullseye` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
+| debian sid | `x86_64`,`arm64` |  `/\d\.\d{3}\.\d+-debian-sid/` | [debian-sid](https://hub.docker.com/r/myoung34/github-runner/tags?page=1&name=debian-sid) | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with `-debian-sid` are included and created on [upstream tags](https://github.com/actions/runner/tags). | |
 
 These containers are built via Github actions that [copy the dockerfile](https://github.com/myoung34/docker-github-actions-runner/blob/master/.github/workflows/deploy.yml#L47), changing the `FROM` and building to provide simplicity.
 
@@ -55,10 +53,11 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 
 | Environment Variable | Description |
 | --- | --- |
+| `RUN_AS_ROOT` | Boolean to run as root. If `true`: will run as root. If `True` and the user is overridden it will error. If any other value it will run as the `runner` user and allow an optional override. Default is `true` |
 | `RUNNER_NAME` | The name of the runner to use. Supercedes (overrides) `RUNNER_NAME_PREFIX` |
 | `RUNNER_NAME_PREFIX` | A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide `RUNNER_NAME`. Defaults to `github-runner` |
 | `ACCESS_TOKEN` | A [github PAT](https://docs.github.com/en/github/authenticating-to-github/creating-a-personal-access-token) to use to generate `RUNNER_TOKEN` dynamically at container start. Not using this requires a valid `RUNNER_TOKEN` |
-| `RUNNER_SCOPE` | The scope the runner will be registered on. Valid values are `repo`, `org` and `ent`. For 'org' and 'enterprise', `ACCESS_TOKEN` is required and `REPO_URL` is unneccesary. If 'org', requires `ORG_NAME`; if 'enterprise', requires `ENTERPRISE_NAME`. Default is 'repo'. |
+| `RUNNER_SCOPE` | The scope the runner will be registered on. Valid values are `repo`, `org` and `ent`. For 'org' and 'enterprise', `ACCESS_TOKEN` is required and `REPO_URL` is unnecessary. If 'org', requires `ORG_NAME`; if 'enterprise', requires `ENTERPRISE_NAME`. Default is 'repo'. |
 | `ORG_NAME` | The organization name for the runner to register under. Requires `RUNNER_SCOPE` to be 'org'. No default value. |
 | `ENTERPRISE_NAME` | The enterprise name for the runner to register under. Requires `RUNNER_SCOPE` to be 'enterprise'. No default value. |
 | `LABELS` | A comma separated string to indicate the labels. Default is 'default' |
@@ -71,341 +70,3 @@ These containers are built via Github actions that [copy the dockerfile](https:/
 | `CONFIGURED_ACTIONS_RUNNER_FILES_DIR` | Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
 | `EPHEMERAL` | Optional flag to configure runner with [`--ephemeral` option](https://docs.github.com/en/actions/hosting-your-own-runners/autoscaling-with-self-hosted-runners#using-ephemeral-runners-for-autoscaling). Ephemeral runners are suitable for autoscaling. |
 | `DISABLE_AUTO_UPDATE` | Optional environment variable to [disable auto updates](https://github.blog/changelog/2022-02-01-github-actions-self-hosted-runners-can-now-disable-automatic-updates/). Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |
-
-## Examples ##
-
-### Note ###
-
-If you're using a RHEL based OS with SELinux, add `--security-opt=label=disable` to prevent [permission denied](https://github.com/myoung34/docker-github-actions-runner/issues/9)
-
-### Manual Org Runner ###
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e RUNNER_NAME_PREFIX="myrunner" \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e RUNNER_SCOPE="org" \
-  -e DISABLE_AUTO_UPDATE="true" \
-  -e ORG_NAME="octokode" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-### Manual per Repo Runner ###
-
-```
-docker run -d --restart always --name github-runner \
-  -e REPO_URL="https://github.com/myoung34/repo" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-Adding the reusage of the registered runner (can be propogated to all other approaches):
-
-```shell
-# per repo
-docker run -d --restart always --name github-runner \
-  -e REPO_URL="https://github.com/myoung34/repo" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_TOKEN="footoken" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e CONFIGURED_ACTIONS_RUNNER_FILES_DIR="/actions-runner-files" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  -v /tmp/foo:/actions-runner-files \
-  myoung34/github-runner:latest
-```
-
-Shell wrapper:
-
-```shell
-function github-runner {
-    name=github-runner-${1//\//-}
-    org=$(dirname $1)
-    repo=$(basename $1)
-    tag=${3:-latest}
-    docker rm -f $name
-    docker run -d --restart=always \
-        -e REPO_URL="https://github.com/${org}/${repo}" \
-        -e RUNNER_TOKEN="$2" \
-        -e RUNNER_NAME="linux-${repo}" \
-        -e RUNNER_WORKDIR="/tmp/github-runner-${repo}" \
-        -e RUNNER_GROUP="my-group" \
-        -e LABELS="my-label,other-label" \
-        -v /var/run/docker.sock:/var/run/docker.sock \
-        -v /tmp/github-runner-${repo}:/tmp/github-runner-${repo} \
-        --name $name myoung34/github-runner:latest
-}
-
-github-runner your-account/your-repo       AARGHTHISISYOURGHACTIONSTOKEN
-github-runner your-account/some-other-repo ARGHANOTHERGITHUBACTIONSTOKEN ubuntu-focal
-```
-
-Or `docker-compose.yml`:
-
-```yml
-version: '2.3'
-
-services:
-  worker:
-    image: myoung34/github-runner:latest
-    environment:
-      REPO_URL: https://github.com/example/repo
-      RUNNER_NAME: example-name
-      RUNNER_TOKEN: someGithubTokenHere
-      RUNNER_WORKDIR: /tmp/runner/work
-      RUNNER_GROUP: my-group
-      RUNNER_SCOPE: 'repo'
-      LABELS: linux,x64,gpu
-    security_opt:
-      # needed on SELinux systems to allow docker container to manage other docker containers
-      - label:disable
-    volumes:
-      - '/var/run/docker.sock:/var/run/docker.sock'
-      - '/tmp/runner:/tmp/runner'
-      # note: a quirk of docker-in-docker is that this path
-      # needs to be the same path on host and inside the container,
-      # docker mgmt cmds run outside of docker but expect the paths from within
-```
-
-### Nomad ###
-
-```hcl
-job "github_runner" {
-  datacenters = ["home"]
-  type = "system"
-
-  task "runner" {
-    driver = "docker"
-
-    env {
-      ACCESS_TOKEN       = "footoken"
-      RUNNER_NAME_PREFIX = "myrunner"
-      RUNNER_WORKDIR     = "/tmp/github-runner-your-repo"
-      RUNNER_GROUP       = "my-group"
-      RUNNER_SCOPE       = "org"
-      ORG_NAME           = "octokode"
-      LABELS             = "my-label,other-label"
-    }
-
-    config {
-      image = "myoung34/github-runner:latest"
-      
-      privileged  = true
-      userns_mode = "host"
-
-      volumes = [
-        "/var/run/docker.sock:/var/run/docker.sock",
-        "/tmp/github-runner-your-repo:/tmp/github-runner-your-repo",
-      ]
-    }
-  }
-}
-```
-
-### Kubernetes ###
-
-```yml
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: actions-runner
-  namespace: runners
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: actions-runner
-  template:
-    metadata:
-      labels:
-        app: actions-runner
-    spec:
-      volumes:
-      - name: dockersock
-        hostPath:
-          path: /var/run/docker.sock
-      - name: workdir
-        hostPath:
-          path: /tmp/github-runner-your-repo
-      containers:
-      - name: runner
-        image: myoung34/github-runner:latest
-        env:
-        - name: ACCESS_TOKEN
-          value: foo-access-token
-        - name: RUNNER_SCOPE
-          value: "org"
-        - name: ORG_NAME
-          value: octokode
-        - name: LABELS
-          value: my-label,other-label
-        - name: RUNNER_TOKEN
-          value: footoken
-        - name: REPO_URL
-          value: https://github.com/your-account/your-repo
-        - name: RUNNER_NAME_PREFIX
-          value: foo
-        - name: RUNNER_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: RUNNER_WORKDIR
-          value: /tmp/github-runner-your-repo
-        - name: RUNNER_GROUP
-          value: my-group
-        volumeMounts:
-        - name: dockersock
-          mountPath: /var/run/docker.sock
-        - name: workdir
-          mountPath: /tmp/github-runner-your-repo
-```
-
-## Usage From GH Actions Workflow ##
-
-```yml
-name: Package
-
-on:
-  release:
-    types: [created]
-
-jobs:
-  build:
-    runs-on: self-hosted
-    steps:
-    - uses: actions/checkout@v1
-    - name: build packages
-      run: make all
-```
-
-## Automatically Acquiring a Runner Token  ##
-
-A runner token can be automatically acquired at runtime if `ACCESS_TOKEN` (a GitHub personal access token) is a supplied. This uses the [GitHub Actions API](https://developer.github.com/v3/actions/self_hosted_runners/#create-a-registration-token). e.g.:
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e RUNNER_SCOPE="org" \
-  -e ORG_NAME="octokode" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-## Create GitHub personal access token  ##
-
-Creating GitHub personal access token (PAT) for using by self-hosted runner make sure the following scopes are selected:
-
-* repo (all)
-* admin:org (all) **_(mandatory for organization-wide runner)_**
-* admin:enterprise (all) **_(mandatory for enterprise-wide runner)_**
-* admin:public_key - read:public_key
-* admin:repo_hook - read:repo_hook
-* admin:org_hook
-* notifications
-* workflow
-
-Also, when creating a PAT for self-hosted runner which will process events from several repositories of the particular organization, create the PAT using organization owner account. Otherwise your new PAT will not have sufficient privileges for all repositories.
-
-## Run a runner on enterprise scope  ##
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e ACCESS_TOKEN="footoken" \
-  -e RUNNER_NAME="foo-runner" \
-  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo" \
-  -e RUNNER_GROUP="my-group" \
-  -e RUNNER_SCOPE="enterprise" \
-  -e ENTERPRISE_NAME="my-enterprise" \
-  -e LABELS="my-label,other-label" \
-  -v /var/run/docker.sock:/var/run/docker.sock \
-  -v /tmp/github-runner-your-repo:/tmp/github-runner-your-repo \
-  myoung34/github-runner:latest
-```
-
-## Ephemeral mode
-
-GitHub's hosted runners are completely ephemeral.  You can remove all its data without breaking all future jobs.
-
-To achieve the same resilience in a self-hosted runner:
-  1. override the command for your runner with `/ephemeral-runner.sh` (which will terminate after one job executes)
-  2. don't mount a local folder into `RUNNER_WORKDIR` (to ensure no filesystem persistence)
-  3. run the container with `--rm` (to delete it after termination)
-  4. wrap the container execution in a system service that restarts (to start a fresh container after each job)
-
-Here's an example service definition for systemd:
-
-```
-# Install with:
-#   sudo install -m 644 ephemeral-github-actions-runner.service /etc/systemd/system/
-#   sudo systemctl daemon-reload
-#   sudo systemctl enable ephemeral-github-actions-runner
-# Run with:
-#   sudo systemctl start ephemeral-github-actions-runner
-# Stop with:
-#   sudo systemctl stop ephemeral-github-actions-runner
-# See live logs with:
-#   journalctl -f -u ephemeral-github-actions-runner.service --no-hostname --no-tail
-
-[Unit]
-Description=Ephemeral GitHub Actions Runner Container
-After=docker.service
-Requires=docker.service
-
-[Service]
-TimeoutStartSec=0
-Restart=always
-ExecStartPre=-/usr/bin/docker stop %n
-ExecStartPre=-/usr/bin/docker rm %n
-ExecStartPre=-/usr/bin/docker pull myoung34/github-runner:latest
-ExecStart=/usr/bin/docker run --rm \
-                              --env-file /etc/ephemeral-github-actions-runner.env \
-                              -v /var/run/docker.sock:/var/run/docker.sock \
-                              --name %n myoung34/github-runner:latest \
-                              /ephemeral-runner.sh
-
-
-[Install]
-WantedBy=multi-user.target
-```
-
-And an example of the corresponding env file that the service reads from:
-
-```
-# Install with:
-#   sudo install -m 600 ephemeral-github-actions-runner.env /etc/
-REPO_URL=https://github.com/your-org/your-repo
-RUNNER_NAME=your-runner-name-here
-ACCESS_TOKEN=foo-access-token
-RUNNER_WORKDIR=/tmp/runner/work
-LABELS=any-custom-labels-go-here
-EPHEMERAL=true
-```
-
-## Proxy Support
-
-To run the github runners behind a proxy, you need to pass the [proxy parameters required for the GitHub Runner](https://docs.github.com/en/actions/hosting-your-own-runners/using-a-proxy-server-with-self-hosted-runners) as environment variables. 
-Note: The `http://` as prefix is required by the GitHub Runner.
-
-```shell
-docker run -d --restart always --name github-runner \
-  -e https_proxy="http://myproxy:3128" \
-  -e http_proxy="http://myproxy:3128" \
-  -e RUNNER_NAME_PREFIX="myrunner" \
-  # ...
-  myoung34/github-runner:latest

SECURITY.md

@@ -4,7 +4,7 @@ If you believe you have found a security vulnerability, please report it to me a
 
 ## Reporting Security Issues
 
-**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).  
+**Please do not report security vulnerabilities through public GitHub issues.** Instead, please report them to me directly at [myoung34@my.apsu.edu](mailto:myoung34@my.apsu.edu).
 
 If you'd like to communicate securely, my keybase is [here](https://keybase.io/3vilpenguin)
 

entrypoint.sh

@@ -1,4 +1,5 @@
 #!/usr/bin/dumb-init /bin/bash
+# shellcheck shell=bash
 
 export RUNNER_ALLOW_RUNASROOT=1
 export PATH=$PATH:/actions-runner
@@ -25,6 +26,7 @@ _RUNNER_WORKDIR=${RUNNER_WORKDIR:-/_work}
 _LABELS=${LABELS:-default}
 _RUNNER_GROUP=${RUNNER_GROUP:-Default}
 _GITHUB_HOST=${GITHUB_HOST:="github.com"}
+_RUN_AS_ROOT=${RUN_AS_ROOT:="true"}
 
 # ensure backwards compatibility
 if [[ -z $RUNNER_SCOPE ]]; then
@@ -59,24 +61,22 @@ case ${RUNNER_SCOPE} in
 esac
 
 configure_runner() {
+  ARGS=()
   if [[ -n "${ACCESS_TOKEN}" ]]; then
     echo "Obtaining the token of the runner"
     _TOKEN=$(ACCESS_TOKEN="${ACCESS_TOKEN}" bash /token.sh)
     RUNNER_TOKEN=$(echo "${_TOKEN}" | jq -r .token)
   fi
 
+  # shellcheck disable=SC2153
   if [ -n "${EPHEMERAL}" ]; then
     echo "Ephemeral option is enabled"
-    _EPHEMERAL="--ephemeral"
-  else
-    _EPHEMERAL=""
+    ARGS+=("--ephemeral")
   fi
 
   if [ -n "${DISABLE_AUTO_UPDATE}" ]; then
     echo "Disable auto update option is enabled"
-    _AUTO_UPDATE="--disableupdate"
-  else
-    _AUTO_UPDATE=""
+    ARGS+=("--disableupdate")
   fi
 
   echo "Configuring"
@@ -89,8 +89,10 @@ configure_runner() {
       --runnergroup "${_RUNNER_GROUP}" \
       --unattended \
       --replace \
-      ${_EPHEMERAL} \
-      ${_AUTO_UPDATE}
+      "${ARGS[@]}"
+
+  [[ ! -d "${_RUNNER_WORKDIR}" ]] && mkdir "${_RUNNER_WORKDIR}"
+
 }
 
 
@@ -124,5 +126,22 @@ if [[ ${_DISABLE_AUTOMATIC_DEREGISTRATION} == "false" ]]; then
   trap deregister_runner SIGINT SIGQUIT SIGTERM INT TERM QUIT
 fi
 
-# Container's command (CMD) execution
-"$@"
+# Container's command (CMD) execution as runner user
+
+
+if [[ ${_RUN_AS_ROOT} == "true" ]]; then
+  if [[ $(id -u) -eq 0 ]]; then
+    "$@"
+  else
+    echo "ERROR: RUN_AS_ROOT env var is set to true but the user has been overridden and is not running as root, but UID '$(id -u)'"
+    exit 1
+  fi
+else
+  if [[ $(id -u) -eq 0 ]]; then
+    [[ -n "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}" ]] && /usr/bin/chown -R runner "${CONFIGURED_ACTIONS_RUNNER_FILES_DIR}"
+    /usr/bin/chown -R runner "${_RUNNER_WORKDIR}" /opt/hostedtoolcache/ /actions-runner
+    /usr/sbin/gosu runner "$@"
+  else
+    "$@"
+  fi
+fi

ephemeral-runner.sh

@@ -1,36 +0,0 @@
-#!/bin/bash
-
-echo "*** Starting ephemeral runner. ***"
-/actions-runner/run.sh --ephemeral
-rv=$?
-
-# See exit code constants in the runner source here:
-# https://github.com/actions/runner/blob/be96323/src/Runner.Common/Constants.cs#L135
-if [[ $rv == 4 ]]; then
-  # The runner software was updated.
-  echo "*** Software update detected. ***"
-
-  echo "*** Waiting for update to complete. ***"
-  # Hard-coded sleep.  Without some delay, the update is still in progress in
-  # the background, leading to failures when we re-launch.
-  sleep 10
-
-  # Now add an adaptive delay, where we loop and check if the Runner is usable
-  # yet.  As soon as it is, break.
-  for i in $(seq 10); do
-    if /actions-runner/bin/Runner.Listener --version &>/dev/null; then
-      break
-    fi
-
-    echo "*** Update still in progress... ***"
-    sleep 5
-  done
-
-  # Now re-launch the script.
-  echo "*** Re-launching runner. ***"
-  exec "$0"
-fi
-
-# For any other return value, let the script and the Docker container terminate.
-echo "*** Exit code $rv ***"
-exit $rv

install_actions.sh

@@ -3,9 +3,7 @@ GH_RUNNER_VERSION=$1
 TARGETPLATFORM=$2
 
 export TARGET_ARCH="x64"
-if [[ $TARGETPLATFORM == "linux/arm/v7" ]]; then
-  export TARGET_ARCH="arm"
-elif [[ $TARGETPLATFORM == "linux/arm64" ]]; then
+if [[ $TARGETPLATFORM == "linux/arm64" ]]; then
   export TARGET_ARCH="arm64"
 fi
 curl -L "https://github.com/actions/runner/releases/download/v${GH_RUNNER_VERSION}/actions-runner-linux-${TARGET_ARCH}-${GH_RUNNER_VERSION}.tar.gz" > actions.tar.gz

sider.yml

@@ -0,0 +1,4 @@
+linter:
+  actionlint:
+    ignore:
+      - ".*Quote this to prevent word splitting.*"