From 0d7918d4a2abe005e07c72dee0300f14269e0bcc Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Tue, 30 Jul 2024 10:49:59 -0500 Subject: [PATCH 01/29] chore: adds a standard code ownership configuration Signed-off-by: Nathan Klick --- .github/CODEOWNERS | 43 +++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 43 insertions(+) create mode 100644 .github/CODEOWNERS diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS new file mode 100644 index 0000000..0ed90c0 --- /dev/null +++ b/.github/CODEOWNERS @@ -0,0 +1,43 @@ +################################### +##### Global Protection Rule ###### +################################### +# NOTE: This rule is overriden by the more specific rules below. This is the catch-all rule for all files not covered by the more specific rules below. +* @hashgraph/release-engineering-managers @hashgraph/product-security + +############################ +##### Project Files ###### +############################ + +/legacy/ @hashgraph/release-engineering-managers @hashgraph/product-security + +######################### +##### Core Files ###### +######################### + +# NOTE: Must be placed last to ensure enforcement over all other rules + +# Protection Rules for Github Configuration Files and Actions Workflows +/.github/ @hashgraph/release-engineering-managers +/.github/workflows/ @hashgraph/release-engineering-managers @hashgraph/product-security @hashgraph/devops-ci + + +# Codacy Tool Configurations +/config/ @hashgraph/release-engineering-managers +.remarkrc @hashgraph/release-engineering-managers + +# Semantic Release Configuration +.releaserc @hashgraph/release-engineering-managers + +# Self-protection for root CODEOWNERS files (this file should not exist and should definitely require approval) +/CODEOWNERS @hashgraph/release-engineering-managers + +# Protect the repository root files +/README.md @hashgraph/release-engineering-managers +**/LICENSE @hashgraph/release-engineering-managers + +# CodeCov configuration +**/codecov.yml @hashgraph/release-engineering-managers + +# Git Ignore definitions +**/.gitignore @hashgraph/release-engineering-managers +**/.gitignore.* @hashgraph/release-engineering-managers From 9b70015eeca61515dbca19d3cf972df7be7cd584 Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Tue, 30 Jul 2024 10:50:35 -0500 Subject: [PATCH 02/29] build: adds a standard dependabot configuration Signed-off-by: Nathan Klick --- .github/dependabot.yml | 7 +++++++ 1 file changed, 7 insertions(+) create mode 100644 .github/dependabot.yml diff --git a/.github/dependabot.yml b/.github/dependabot.yml new file mode 100644 index 0000000..10256a1 --- /dev/null +++ b/.github/dependabot.yml @@ -0,0 +1,7 @@ +version: 2 +updates: + - package-ecosystem: "github-actions" + directory: "/" + schedule: + interval: "daily" + open-pull-requests-limit: 10 From 0179e91d20dd18f283604a045561fe888abb6555 Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Tue, 30 Jul 2024 10:50:48 -0500 Subject: [PATCH 03/29] chore: adds a standard pull request template Signed-off-by: Nathan Klick --- .github/pull_request_template.md | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .github/pull_request_template.md diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md new file mode 100644 index 0000000..d5aaddc --- /dev/null +++ b/.github/pull_request_template.md @@ -0,0 +1,9 @@ +## Description + +This pull request changes the following: + +* TBD + +### Related Issues + +* Closes # From 56a9a7af5ac6059073c91f0b7167897a51e11dd7 Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Tue, 30 Jul 2024 10:51:09 -0500 Subject: [PATCH 04/29] chore: update git ignore configuration to match standards Signed-off-by: Nathan Klick --- .gitignore | 818 +++++++++++++++++++++++++++++++++++++++++++++++++++-- 1 file changed, 802 insertions(+), 16 deletions(-) diff --git a/.gitignore b/.gitignore index 2cbc1ad..0468d22 100644 --- a/.gitignore +++ b/.gitignore @@ -1,16 +1,802 @@ -# Cache objects -packer_cache/ - -# Crash log -crash.log - -# https://www.packer.io/guides/hcl/variables -# Exclude all .pkrvars.hcl files, which are likely to contain sensitive data, -# such as password, private keys, and other secrets. These should not be part of -# version control as they are data points which are potentially sensitive and -# subject to change depending on the environment. -# -*.pkrvars.hcl - -# For built boxes -*.box +######################################################################################################################## +# Autogenerated Definitions +######################################################################################################################## + +### NotepadPP template +# Notepad++ backups # +*.bak + +### MonoDevelop template +#User Specific +*.userprefs +*.usertasks + +#Mono Project Files +*.pidb +*.resources +test-results/ + +### Xcode template +## User settings +xcuserdata/ + +## Xcode 8 and earlier +*.xcscmblueprint +*.xccheckout + +### Diff template +*.patch +*.diff + +### Eclipse template +.metadata +bin/ +tmp/ +*.tmp +*.bak +*.swp +*~.nib +local.properties +.settings/ +.loadpath +.recommenders + +# External tool builders +.externalToolBuilders/ + +# Locally stored "Eclipse launch configurations" +*.launch + +# PyDev specific (Python IDE for Eclipse) +*.pydevproject + +# CDT-specific (C/C++ Development Tooling) +.cproject + +# CDT- autotools +.autotools + +# Java annotation processor (APT) +.factorypath + +# PDT-specific (PHP Development Tools) +.buildpath + +# sbteclipse plugin +.target + +# Tern plugin +.tern-project + +# TeXlipse plugin +.texlipse + +# STS (Spring Tool Suite) +.springBeans + +# Code Recommenders +.recommenders/ + +# Annotation Processing +.apt_generated/ +.apt_generated_test/ + +# Scala IDE specific (Scala & Java development for Eclipse) +.cache-main +.scala_dependencies +.worksheet + +# Uncomment this line if you wish to ignore the project description file. +# Typically, this file would be tracked if it contains build/dependency configurations: +#.project + +### Backup template +*.bak +*.gho +*.ori +*.orig +*.tmp + +### Windows template +# Windows thumbnail cache files +Thumbs.db +Thumbs.db:encryptable +ehthumbs.db +ehthumbs_vista.db + +# Dump file +*.stackdump + +# Folder config file +[Dd]esktop.ini + +# Recycle Bin used on file shares +$RECYCLE.BIN/ + +# Windows Installer files +*.cab +*.msi +*.msix +*.msm +*.msp + +# Windows shortcuts +*.lnk + +### KDevelop4 template +*.kdev4 +.kdev4/ + +### Vagrant template +# General +.vagrant/ + +# Log files (if you are creating logs in debug mode, uncomment this) +# *.log + +### OpenSSL template +# OpenSSL-related files best not committed + +## Certificate Authority +*.ca + +## Certificate +*.crt + +## Certificate Sign Request +*.csr + +## Certificate +*.der + +## Key database file +*.kdb + +## OSCP request data +*.org + +## PKCS #12 +*.p12 + +## PEM-encoded certificate data +*.pem + +## Random number seed +*.rnd + +## SSLeay data +*.ssleay + +## S/MIME message +*.smime + +### NetBeans template +**/nbproject/private/ +**/nbproject/Makefile-*.mk +**/nbproject/Package-*.bash +build/ +nbbuild/ +dist/ +nbdist/ +.nb-gradle/ + +### MicrosoftOffice template +*.tmp + +# Word temporary +~$*.doc* + +# Word Auto Backup File +Backup of *.doc* + +# Excel temporary +~$*.xls* + +# Excel Backup File +*.xlk + +# PowerPoint temporary +~$*.ppt* + +# Visio autosave temporary files +*.~vsd* + +### JetBrains template +# Covers JetBrains IDEs: IntelliJ, RubyMine, PhpStorm, AppCode, PyCharm, CLion, Android Studio, WebStorm and Rider +# Reference: https://intellij-support.jetbrains.com/hc/en-us/articles/206544839 + +# User-specific stuff +.idea/**/workspace.xml +.idea/**/tasks.xml +.idea/**/usage.statistics.xml +.idea/**/dictionaries +.idea/**/shelf + +# AWS User-specific +.idea/**/aws.xml + +# Generated files +.idea/**/contentModel.xml + +# Sensitive or high-churn files +.idea/**/dataSources/ +.idea/**/dataSources.ids +.idea/**/dataSources.local.xml +.idea/**/sqlDataSources.xml +.idea/**/dynamic.xml +.idea/**/uiDesigner.xml +.idea/**/dbnavigator.xml + +# Gradle +.idea/**/gradle.xml +.idea/**/libraries + +# Gradle and Maven with auto-import +# When using Gradle or Maven with auto-import, you should exclude module files, +# since they will be recreated, and may cause churn. Uncomment if using +# auto-import. +# .idea/artifacts +# .idea/compiler.xml +# .idea/jarRepositories.xml +# .idea/modules.xml +# .idea/*.iml +# .idea/modules +# *.iml +# *.ipr + +.idea/ + +# CMake +cmake-build-*/ + +# Mongo Explorer plugin +.idea/**/mongoSettings.xml + +# File-based project format +*.iws + +# IntelliJ +out/ + +# mpeltonen/sbt-idea plugin +.idea_modules/ + +# JIRA plugin +atlassian-ide-plugin.xml + +# Cursive Clojure plugin +.idea/replstate.xml + +# SonarLint plugin +.idea/sonarlint/ + +# Crashlytics plugin (for Android Studio and IntelliJ) +com_crashlytics_export_strings.xml +crashlytics.properties +crashlytics-build.properties +fabric.properties + +# Editor-based Rest Client +.idea/httpRequests + +# Android studio 3.1+ serialized cache file +.idea/caches/build_file_checksums.ser + +### Linux template +*~ + +# temporary files which can be created if a process still has a handle open of a deleted file +.fuse_hidden* + +# KDE directory preferences +.directory + +# Linux trash folder which might appear on any partition or disk +.Trash-* + +# .nfs files are created when an open file is removed but is still being accessed +.nfs* + +### VisualStudio template +## Ignore Visual Studio temporary files, build results, and +## files generated by popular Visual Studio add-ons. +## +## Get latest from https://github.com/github/gitignore/blob/main/VisualStudio.gitignore + +# User-specific files +*.rsuser +*.suo +*.user +*.userosscache +*.sln.docstates + +# User-specific files (MonoDevelop/Xamarin Studio) +*.userprefs + +# Mono auto generated files +mono_crash.* + +# Build results +[Dd]ebug/ +[Dd]ebugPublic/ +[Rr]elease/ +[Rr]eleases/ +x64/ +x86/ +[Ww][Ii][Nn]32/ +[Aa][Rr][Mm]/ +[Aa][Rr][Mm]64/ +bld/ +[Bb]in/ +[Oo]bj/ +[Ll]og/ +[Ll]ogs/ + +# Visual Studio 2015/2017 cache/options directory +.vs/ +# Uncomment if you have tasks that create the project's static files in wwwroot +#wwwroot/ + +# Visual Studio 2017 auto generated files +Generated\ Files/ + +# MSTest test Results +[Tt]est[Rr]esult*/ +[Bb]uild[Ll]og.* + +# NUnit +*.VisualState.xml +TestResult.xml +nunit-*.xml + +# Build Results of an ATL Project +[Dd]ebugPS/ +[Rr]eleasePS/ +dlldata.c + +# Benchmark Results +BenchmarkDotNet.Artifacts/ + +# .NET Core +project.lock.json +project.fragment.lock.json +artifacts/ + +# ASP.NET Scaffolding +ScaffoldingReadMe.txt + +# StyleCop +StyleCopReport.xml + +# Files built by Visual Studio +*_i.c +*_p.c +*_h.h +*.ilk +*.meta +*.obj +*.iobj +*.pch +*.pdb +*.ipdb +*.pgc +*.pgd +*.rsp +*.sbr +*.tlb +*.tli +*.tlh +*.tmp +*.tmp_proj +*_wpftmp.csproj +*.log +*.tlog +*.vspscc +*.vssscc +.builds +*.pidb +*.svclog +*.scc + +# Chutzpah Test files +_Chutzpah* + +# Visual C++ cache files +ipch/ +*.aps +*.ncb +*.opendb +*.opensdf +*.sdf +*.cachefile +*.VC.db +*.VC.VC.opendb + +# Visual Studio profiler +*.psess +*.vsp +*.vspx +*.sap + +# Visual Studio Trace Files +*.e2e + +# TFS 2012 Local Workspace +$tf/ + +# Guidance Automation Toolkit +*.gpState + +# ReSharper is a .NET coding add-in +_ReSharper*/ +*.[Rr]e[Ss]harper +*.DotSettings.user + +# TeamCity is a build add-in +_TeamCity* + +# DotCover is a Code Coverage Tool +*.dotCover + +# AxoCover is a Code Coverage Tool +.axoCover/* +!.axoCover/settings.json + +# Coverlet is a free, cross platform Code Coverage Tool +coverage*.json +coverage*.xml +coverage*.info + +# Visual Studio code coverage results +*.coverage +*.coveragexml + +# NCrunch +_NCrunch_* +.*crunch*.local.xml +nCrunchTemp_* + +# MightyMoose +*.mm.* +AutoTest.Net/ + +# Web workbench (sass) +.sass-cache/ + +# Installshield output folder +[Ee]xpress/ + +# DocProject is a documentation generator add-in +DocProject/buildhelp/ +DocProject/Help/*.HxT +DocProject/Help/*.HxC +DocProject/Help/*.hhc +DocProject/Help/*.hhk +DocProject/Help/*.hhp +DocProject/Help/Html2 +DocProject/Help/html + +# Click-Once directory +publish/ + +# Publish Web Output +*.[Pp]ublish.xml +*.azurePubxml +# Note: Comment the next line if you want to checkin your web deploy settings, +# but database connection strings (with potential passwords) will be unencrypted +*.pubxml +*.publishproj + +# Microsoft Azure Web App publish settings. Comment the next line if you want to +# checkin your Azure Web App publish settings, but sensitive information contained +# in these scripts will be unencrypted +PublishScripts/ + +# NuGet Packages +*.nupkg +# NuGet Symbol Packages +*.snupkg +# The packages folder can be ignored because of Package Restore +**/[Pp]ackages/* +# except build/, which is used as an MSBuild target. +!**/[Pp]ackages/build/ +# Uncomment if necessary however generally it will be regenerated when needed +#!**/[Pp]ackages/repositories.config +# NuGet v3's project.json files produces more ignorable files +*.nuget.props +*.nuget.targets + +# Microsoft Azure Build Output +csx/ +*.build.csdef + +# Microsoft Azure Emulator +ecf/ +rcf/ + +# Windows Store app package directories and files +AppPackages/ +BundleArtifacts/ +Package.StoreAssociation.xml +_pkginfo.txt +*.appx +*.appxbundle +*.appxupload + +# Visual Studio cache files +# files ending in .cache can be ignored +*.[Cc]ache +# but keep track of directories ending in .cache +!?*.[Cc]ache/ + +# Others +ClientBin/ +~$* +*~ +*.dbmdl +*.dbproj.schemaview +*.jfm +*.pfx +*.publishsettings +orleans.codegen.cs + +# Including strong name files can present a security risk +# (https://github.com/github/gitignore/pull/2483#issue-259490424) +#*.snk + +# Since there are multiple workflows, uncomment next line to ignore bower_components +# (https://github.com/github/gitignore/pull/1529#issuecomment-104372622) +#bower_components/ + +# RIA/Silverlight projects +Generated_Code/ + +# Backup & report files from converting an old project file +# to a newer Visual Studio version. Backup files are not needed, +# because we have git ;-) +_UpgradeReport_Files/ +Backup*/ +UpgradeLog*.XML +UpgradeLog*.htm +ServiceFabricBackup/ +*.rptproj.bak + +# SQL Server files +*.mdf +*.ldf +*.ndf + +# Business Intelligence projects +*.rdl.data +*.bim.layout +*.bim_*.settings +*.rptproj.rsuser +*- [Bb]ackup.rdl +*- [Bb]ackup ([0-9]).rdl +*- [Bb]ackup ([0-9][0-9]).rdl + +# Microsoft Fakes +FakesAssemblies/ + +# GhostDoc plugin setting file +*.GhostDoc.xml + +# Node.js Tools for Visual Studio +.ntvs_analysis.dat +node_modules/ + +# Visual Studio 6 build log +*.plg + +# Visual Studio 6 workspace options file +*.opt + +# Visual Studio 6 auto-generated workspace file (contains which files were open etc.) +*.vbw + +# Visual Studio 6 auto-generated project file (contains which files were open etc.) +*.vbp + +# Visual Studio 6 workspace and project file (working project files containing files to include in project) +*.dsw +*.dsp + +# Visual Studio 6 technical files +*.ncb +*.aps + +# Visual Studio LightSwitch build output +**/*.HTMLClient/GeneratedArtifacts +**/*.DesktopClient/GeneratedArtifacts +**/*.DesktopClient/ModelManifest.xml +**/*.Server/GeneratedArtifacts +**/*.Server/ModelManifest.xml +_Pvt_Extensions + +# Paket dependency manager +.paket/paket.exe +paket-files/ + +# FAKE - F# Make +.fake/ + +# CodeRush personal settings +.cr/personal + +# Python Tools for Visual Studio (PTVS) +__pycache__/ +*.pyc + +# Cake - Uncomment if you are using it +# tools/** +# !tools/packages.config + +# Tabs Studio +*.tss + +# Telerik's JustMock configuration file +*.jmconfig + +# BizTalk build output +*.btp.cs +*.btm.cs +*.odx.cs +*.xsd.cs + +# OpenCover UI analysis results +OpenCover/ + +# Azure Stream Analytics local run output +ASALocalRun/ + +# MSBuild Binary and Structured Log +*.binlog + +# NVidia Nsight GPU debugger configuration file +*.nvuser + +# MFractors (Xamarin productivity tool) working folder +.mfractor/ + +# Local History for Visual Studio +.localhistory/ + +# Visual Studio History (VSHistory) files +.vshistory/ + +# BeatPulse healthcheck temp database +healthchecksdb + +# Backup folder for Package Reference Convert tool in Visual Studio 2017 +MigrationBackup/ + +# Ionide (cross platform F# VS Code tools) working folder +.ionide/ + +# Fody - auto-generated XML schema +FodyWeavers.xsd + +# VS Code files for those working on multiple tools +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +*.code-workspace + +# Local History for Visual Studio Code +.history/ + +# Windows Installer files from build outputs +*.cab +*.msi +*.msix +*.msm +*.msp + +# JetBrains Rider +*.sln.iml + +### LibreOffice template +# LibreOffice locks +.~lock.*# + +### Vim template +# Swap +[._]*.s[a-v][a-z] +!*.svg # comment out if you don't need vector files +[._]*.sw[a-p] +[._]s[a-rt-v][a-z] +[._]ss[a-gi-z] +[._]sw[a-p] + +# Session +Session.vim +Sessionx.vim + +# Temporary +.netrwhist +*~ +# Auto-generated tag files +tags +# Persistent undo +[._]*.un~ + +### Dropbox template +# Dropbox settings and caches +.dropbox +.dropbox.attr +.dropbox.cache + +### Archives template +# It's better to unpack these files and commit the raw source because +# git has its own built in compression methods. +*.7z +*.jar +*.rar +*.zip +*.gz +*.gzip +*.tgz +*.bzip +*.bzip2 +*.bz2 +*.xz +*.lzma +*.cab +*.xar + +# Packing-only formats +*.iso +*.tar + +# Package management formats +*.dmg +*.xpi +*.gem +*.egg +*.deb +*.rpm +*.msi +*.msm +*.msp +*.txz + +### Patch template +*.orig +*.rej + +### macOS template +# General +.DS_Store +.AppleDouble +.LSOverride + +# Icon must end with two \r +Icon + +# Thumbnails +._* + +# Files that might appear in the root of a volume +.DocumentRevisions-V100 +.fseventsd +.Spotlight-V100 +.TemporaryItems +.Trashes +.VolumeIcon.icns +.com.apple.timemachine.donotpresent + +# Directories potentially created on remote AFP share +.AppleDB +.AppleDesktop +Network Trash Folder +Temporary Items +.apdisk + +### GPG template +secring.* + +######################################################################################################################## +# User Specified Definitions +######################################################################################################################## From adcc5fc34335a310b9f202566646b701b5faf5f3 Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Tue, 30 Jul 2024 10:51:21 -0500 Subject: [PATCH 05/29] chore: update the readme documentation Signed-off-by: Nathan Klick --- README.md | 28 ++++++++++++++++++++++++++-- 1 file changed, 26 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 91b9ac1..bbf43e3 100644 --- a/README.md +++ b/README.md @@ -1,2 +1,26 @@ -# runner-images -Custom Github Actions runner base images. +# Hedera Runner Images + +This repository contains customized versions of the [Actions Runner Controller](https://github.com/actions/actions-runner-controller) +container images along with customized build process to automatically build and publish them to the GitHub Container Registry. + +## :warning: Restrictions on Contributions + +Contributions from forked repositories are not accepted. All pull requests initiated from a forked repository will be +automatically closed. + +## Support + +If you have a question on how to use the product, please see our [support guide](https://github.com/hashgraph/.github/blob/main/SUPPORT.md). + +## Contributing + +Contributions are restricted to trusted maintainers. + +## Code of Conduct + +This project is governed by the [Contributor Covenant Code of Conduct](https://github.com/hashgraph/.github/blob/main/CODE_OF_CONDUCT.md). By participating, you are +expected to uphold this code of conduct. + +## License + +[Apache License 2.0](LICENSE) From 2cabe5516d32bfbbc379719b51588cd1535c9f20 Mon Sep 17 00:00:00 2001 From: Nathan Klick Date: Tue, 30 Jul 2024 10:51:45 -0500 Subject: [PATCH 06/29] chore: import the runner container definitions from the ARC upstream Signed-off-by: Nathan Klick --- legacy/runner/.dockerignore | 2 + legacy/runner/Makefile | 161 ++++++++++++++++ legacy/runner/VERSION | 2 + ...nner-dind-rootless.ubuntu-20.04.dockerfile | 157 +++++++++++++++ ...nner-dind-rootless.ubuntu-22.04.dockerfile | 135 +++++++++++++ ...ctions-runner-dind.ubuntu-20.04.dockerfile | 144 ++++++++++++++ ...ctions-runner-dind.ubuntu-22.04.dockerfile | 120 ++++++++++++ .../actions-runner.ubuntu-20.04.dockerfile | 137 +++++++++++++ .../actions-runner.ubuntu-22.04.dockerfile | 114 +++++++++++ legacy/runner/docker-shim.sh | 17 ++ legacy/runner/entrypoint-dind-rootless.sh | 56 ++++++ legacy/runner/entrypoint-dind.sh | 75 ++++++++ legacy/runner/entrypoint.sh | 30 +++ legacy/runner/graceful-stop.sh | 99 ++++++++++ .../hooks/job-completed.d/update-status | 4 + legacy/runner/hooks/job-completed.sh | 12 ++ .../runner/hooks/job-started.d/update-status | 4 + legacy/runner/hooks/job-started.sh | 12 ++ legacy/runner/logger.sh | 73 +++++++ legacy/runner/startup.sh | 180 ++++++++++++++++++ legacy/runner/update-status | 52 +++++ legacy/runner/wait.sh | 17 ++ 22 files changed, 1603 insertions(+) create mode 100644 legacy/runner/.dockerignore create mode 100644 legacy/runner/Makefile create mode 100644 legacy/runner/VERSION create mode 100644 legacy/runner/actions-runner-dind-rootless.ubuntu-20.04.dockerfile create mode 100644 legacy/runner/actions-runner-dind-rootless.ubuntu-22.04.dockerfile create mode 100644 legacy/runner/actions-runner-dind.ubuntu-20.04.dockerfile create mode 100644 legacy/runner/actions-runner-dind.ubuntu-22.04.dockerfile create mode 100644 legacy/runner/actions-runner.ubuntu-20.04.dockerfile create mode 100644 legacy/runner/actions-runner.ubuntu-22.04.dockerfile create mode 100755 legacy/runner/docker-shim.sh create mode 100644 legacy/runner/entrypoint-dind-rootless.sh create mode 100755 legacy/runner/entrypoint-dind.sh create mode 100755 legacy/runner/entrypoint.sh create mode 100644 legacy/runner/graceful-stop.sh create mode 100755 legacy/runner/hooks/job-completed.d/update-status create mode 100755 legacy/runner/hooks/job-completed.sh create mode 100755 legacy/runner/hooks/job-started.d/update-status create mode 100644 legacy/runner/hooks/job-started.sh create mode 100755 legacy/runner/logger.sh create mode 100755 legacy/runner/startup.sh create mode 100755 legacy/runner/update-status create mode 100644 legacy/runner/wait.sh diff --git a/legacy/runner/.dockerignore b/legacy/runner/.dockerignore new file mode 100644 index 0000000..f3e36c5 --- /dev/null +++ b/legacy/runner/.dockerignore @@ -0,0 +1,2 @@ +*.dockerfile +Makefile diff --git a/legacy/runner/Makefile b/legacy/runner/Makefile new file mode 100644 index 0000000..f08ac6b --- /dev/null +++ b/legacy/runner/Makefile @@ -0,0 +1,161 @@ +DOCKER_USER ?= summerwind +DOCKER ?= docker +DEFAULT_RUNNER_NAME ?= ${DOCKER_USER}/actions-runner +DIND_RUNNER_NAME ?= ${DOCKER_USER}/actions-runner-dind +DIND_ROOTLESS_RUNNER_NAME ?= ${DOCKER_USER}/actions-runner-dind-rootless +OS_IMAGE ?= ubuntu-22.04 +TARGETPLATFORM ?= $(shell arch) + +RUNNER_VERSION ?= 2.318.0 +RUNNER_CONTAINER_HOOKS_VERSION ?= 0.6.1 +DOCKER_VERSION ?= 24.0.7 + +# default list of platforms for which multiarch image is built +ifeq (${PLATFORMS}, ) + export PLATFORMS="linux/amd64,linux/arm64" +endif + +# if IMG_RESULT is unspecified, by default the image will be pushed to registry +ifeq (${IMG_RESULT}, load) + export PUSH_ARG="--load" + # if load is specified, image will be built only for the build machine architecture. + export PLATFORMS="local" +else ifeq (${IMG_RESULT}, cache) + # if cache is specified, image will only be available in the build cache, it won't be pushed or loaded + # therefore no PUSH_ARG will be specified +else + export PUSH_ARG="--push" +endif + +check-target-platform: +# Handle target platform variants. +# arch command on OS X reports "i386" for Intel CPUs regardless of bitness +ifeq ($(TARGETPLATFORM), $(filter $(TARGETPLATFORM), x86_64 x64 amd64 i386 linux/amd64)) + TARGETPLATFORM = linux/amd64 +else ifeq ($(TARGETPLATFORM), $(filter $(TARGETPLATFORM), arm64 aarch64 linux/arm64)) + TARGETPLATFORM = linux/arm64 +else + $(warning Unsupported target platform $(TARGETPLATFORM)) + $(error Supported target platforms: linux/amd64 and linux/arm64) +endif + +docker-build-set: check-target-platform + ${DOCKER} build \ + --build-arg TARGETPLATFORM=${TARGETPLATFORM} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner.${OS_IMAGE}.dockerfile \ + -t ${DEFAULT_RUNNER_NAME}:${OS_IMAGE} . + ${DOCKER} build \ + --build-arg TARGETPLATFORM=${TARGETPLATFORM} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind.${OS_IMAGE}.dockerfile \ + -t ${DIND_RUNNER_NAME}:${OS_IMAGE} . + ${DOCKER} build \ + --build-arg TARGETPLATFORM=${TARGETPLATFORM} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind-rootless.${OS_IMAGE}.dockerfile \ + -t "${DIND_ROOTLESS_RUNNER_NAME}:${OS_IMAGE}" . + +docker-build-default: check-target-platform + ${DOCKER} build \ + --build-arg TARGETPLATFORM=${TARGETPLATFORM} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner.${OS_IMAGE}.dockerfile \ + -t ${DEFAULT_RUNNER_NAME}:${OS_IMAGE} . + +docker-build-dind: check-target-platform + ${DOCKER} build \ + --build-arg TARGETPLATFORM=${TARGETPLATFORM} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind.${OS_IMAGE}.dockerfile \ + -t ${DIND_RUNNER_NAME}:${OS_IMAGE} . + +docker-push-default: + ${DOCKER} push "${DEFAULT_RUNNER_NAME}:${OS_IMAGE}" + +docker-push-dind: + ${DOCKER} push "${DIND_RUNNER_NAME}:${OS_IMAGE}" + +docker-push-set: + ${DOCKER} push "${DEFAULT_RUNNER_NAME}:${OS_IMAGE}" + ${DOCKER} push "${DIND_RUNNER_NAME}:${OS_IMAGE}" + ${DOCKER} push "${DIND_ROOTLESS_RUNNER_NAME}:${OS_IMAGE}" + +docker-buildx-set: + export DOCKER_CLI_EXPERIMENTAL=enabled ;\ + export DOCKER_BUILDKIT=1 + @if ! docker buildx ls | grep -q container-builder; then\ + docker buildx create --platform ${PLATFORMS} --name container-builder --use;\ + fi + ${DOCKER} buildx build --platform ${PLATFORMS} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner.${OS_IMAGE}.dockerfile \ + -t "${DEFAULT_RUNNER_NAME}:${OS_IMAGE}" \ + . ${PUSH_ARG} + ${DOCKER} buildx build --platform ${PLATFORMS} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind.${OS_IMAGE}.dockerfile \ + -t "${DIND_RUNNER_NAME}:${OS_IMAGE}" \ + . ${PUSH_ARG} + ${DOCKER} buildx build --platform ${PLATFORMS} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind-rootless.${OS_IMAGE}.dockerfile \ + -t "${DIND_ROOTLESS_RUNNER_NAME}:${OS_IMAGE}" \ + . ${PUSH_ARG} + +docker-buildx-default: + export DOCKER_CLI_EXPERIMENTAL=enabled ;\ + export DOCKER_BUILDKIT=1 + @if ! docker buildx ls | grep -q container-builder; then\ + docker buildx create --platform ${PLATFORMS} --name container-builder --use;\ + fi + ${DOCKER} buildx build --platform ${PLATFORMS} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner.${OS_IMAGE}.dockerfile \ + -t "${DEFAULT_RUNNER_NAME}:${OS_IMAGE}" \ + . ${PUSH_ARG} + +docker-buildx-dind: + export DOCKER_CLI_EXPERIMENTAL=enabled ;\ + export DOCKER_BUILDKIT=1 + @if ! docker buildx ls | grep -q container-builder; then\ + docker buildx create --platform ${PLATFORMS} --name container-builder --use;\ + fi + ${DOCKER} buildx build --platform ${PLATFORMS} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind.${OS_IMAGE}.dockerfile \ + -t "${DIND_RUNNER_NAME}:${OS_IMAGE}" \ + . ${PUSH_ARG} + +docker-buildx-dind-rootless: + export DOCKER_CLI_EXPERIMENTAL=enabled ;\ + export DOCKER_BUILDKIT=1 + @if ! docker buildx ls | grep -q container-builder; then\ + docker buildx create --platform ${PLATFORMS} --name container-builder --use;\ + fi + ${DOCKER} buildx build --platform ${PLATFORMS} \ + --build-arg RUNNER_VERSION=${RUNNER_VERSION} \ + --build-arg RUNNER_CONTAINER_HOOKS_VERSION=${RUNNER_CONTAINER_HOOKS_VERSION} \ + --build-arg DOCKER_VERSION=${DOCKER_VERSION} \ + -f actions-runner-dind-rootless.${OS_IMAGE}.dockerfile \ + -t "${DIND_ROOTLESS_RUNNER_NAME}:${OS_IMAGE}" \ + . ${PUSH_ARG} diff --git a/legacy/runner/VERSION b/legacy/runner/VERSION new file mode 100644 index 0000000..b370e97 --- /dev/null +++ b/legacy/runner/VERSION @@ -0,0 +1,2 @@ +RUNNER_VERSION=2.318.0 +RUNNER_CONTAINER_HOOKS_VERSION=0.6.1 \ No newline at end of file diff --git a/legacy/runner/actions-runner-dind-rootless.ubuntu-20.04.dockerfile b/legacy/runner/actions-runner-dind-rootless.ubuntu-20.04.dockerfile new file mode 100644 index 0000000..1e65c8b --- /dev/null +++ b/legacy/runner/actions-runner-dind-rootless.ubuntu-20.04.dockerfile @@ -0,0 +1,157 @@ +FROM ubuntu:20.04 + +ARG TARGETPLATFORM +ARG RUNNER_VERSION +ARG RUNNER_CONTAINER_HOOKS_VERSION +# Docker and Docker Compose arguments +ENV CHANNEL=stable +ARG DOCKER_COMPOSE_VERSION=v2.23.0 +ARG DUMB_INIT_VERSION=1.2.5 + +# Other arguments +ARG DEBUG=false + +ENV DEBIAN_FRONTEND=noninteractive + +# Use 1001 for compatibility with GitHub-hosted runners +ARG RUNNER_UID=1000 + +RUN apt-get update -y \ + && apt-get install -y software-properties-common \ + && add-apt-repository -y ppa:git-core/ppa \ + && apt-get update -y \ + && apt-get install -y --no-install-recommends \ + build-essential \ + curl \ + ca-certificates \ + dnsutils \ + ftp \ + git \ + iproute2 \ + iputils-ping \ + iptables \ + jq \ + libunwind8 \ + locales \ + netcat \ + net-tools \ + openssh-client \ + parallel \ + python3-pip \ + rsync \ + shellcheck \ + software-properties-common \ + sudo \ + telnet \ + time \ + tzdata \ + uidmap \ + unzip \ + upx \ + wget \ + zip \ + zstd \ + && ln -sf /usr/bin/python3 /usr/bin/python \ + && ln -sf /usr/bin/pip3 /usr/bin/pip \ + && rm -rf /var/lib/apt/lists/* + +# Download latest git-lfs version +RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \ + apt-get install -y --no-install-recommends git-lfs + +# Runner user +RUN adduser --disabled-password --gecos "" --uid $RUNNER_UID runner + +ENV HOME=/home/runner + +# Set-up subuid and subgid so that "--userns-remap=default" works +RUN set -eux; \ + addgroup --system dockremap; \ + adduser --system --ingroup dockremap dockremap; \ + echo 'dockremap:165536:65536' >> /etc/subuid; \ + echo 'dockremap:165536:65536' >> /etc/subgid + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \ + && chmod +x /usr/bin/dumb-init + +ENV RUNNER_ASSETS_DIR=/runnertmp +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \ + && mkdir -p "$RUNNER_ASSETS_DIR" \ + && cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \ + && tar xzf ./runner.tar.gz \ + && rm runner.tar.gz \ + && ./bin/installdependencies.sh \ + && mv ./externals ./externalstmp \ + # libyaml-dev is required for ruby/setup-ruby action. + # It is installed after installdependencies.sh and before removing /var/lib/apt/lists + # to avoid rerunning apt-update on its own. + && apt-get install -y libyaml-dev \ + && rm -rf /var/lib/apt/lists/* + +ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache +RUN mkdir /opt/hostedtoolcache \ + && chgrp runner /opt/hostedtoolcache \ + && chmod g+rwx /opt/hostedtoolcache + +RUN cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \ + && unzip ./runner-container-hooks.zip -d ./k8s \ + && rm -f runner-container-hooks.zip + +# Make the rootless runner directory executable +RUN mkdir /run/user/$RUNNER_UID \ + && chown runner:runner /run/user/$RUNNER_UID \ + && chmod a+x /run/user/$RUNNER_UID + +# We place the scripts in `/usr/bin` so that users who extend this image can +# override them with scripts of the same name placed in `/usr/local/bin`. +COPY entrypoint-dind-rootless.sh startup.sh logger.sh graceful-stop.sh update-status /usr/bin/ +RUN chmod +x /usr/bin/entrypoint-dind-rootless.sh /usr/bin/startup.sh + +# Copy the docker shim which propagates the docker MTU to underlying networks +# to replace the docker binary in the PATH. +COPY docker-shim.sh /usr/local/bin/docker + +# Configure hooks folder structure. +COPY hooks /etc/arc/hooks/ + +# Add the Python "User Script Directory" to the PATH +ENV PATH="${PATH}:${HOME}/.local/bin:/home/runner/bin" +ENV ImageOS=ubuntu20 +ENV DOCKER_HOST=unix:///run/user/$RUNNER_UID/docker.sock +ENV XDG_RUNTIME_DIR=/run/user/$RUNNER_UID + +RUN echo "PATH=${PATH}" > /etc/environment \ + && echo "ImageOS=${ImageOS}" >> /etc/environment \ + && echo "DOCKER_HOST=${DOCKER_HOST}" >> /etc/environment \ + && echo "XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}" >> /etc/environment + +# No group definition, as that makes it harder to run docker. +USER runner + +# This will install docker under $HOME/bin according to the content of the script +RUN export SKIP_IPTABLES=1 \ + && curl -fsSL https://get.docker.com/rootless | sh \ + && /home/runner/bin/docker -v + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && mkdir -p /home/runner/.docker/cli-plugins \ + && curl -fLo /home/runner/.docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \ + && chmod +x /home/runner/.docker/cli-plugins/docker-compose \ + && ln -s /home/runner/.docker/cli-plugins/docker-compose /home/runner/bin/docker-compose \ + && which docker-compose \ + && docker compose version + +# Create folder structure here to avoid permission issues +# when mounting the daemon.json file from a configmap. +RUN mkdir -p /home/runner/.config/docker + +ENTRYPOINT ["/bin/bash", "-c"] +CMD ["entrypoint-dind-rootless.sh"] diff --git a/legacy/runner/actions-runner-dind-rootless.ubuntu-22.04.dockerfile b/legacy/runner/actions-runner-dind-rootless.ubuntu-22.04.dockerfile new file mode 100644 index 0000000..0639ccd --- /dev/null +++ b/legacy/runner/actions-runner-dind-rootless.ubuntu-22.04.dockerfile @@ -0,0 +1,135 @@ +FROM ubuntu:22.04 + +ARG TARGETPLATFORM +ARG RUNNER_VERSION +ARG RUNNER_CONTAINER_HOOKS_VERSION +# Docker and Docker Compose arguments +ENV CHANNEL=stable +ARG DOCKER_COMPOSE_VERSION=v2.23.0 +ARG DUMB_INIT_VERSION=1.2.5 +ARG RUNNER_USER_UID=1001 + +# Other arguments +ARG DEBUG=false + +RUN test -n "$TARGETPLATFORM" || (echo "TARGETPLATFORM must be set" && false) + +ENV DEBIAN_FRONTEND=noninteractive +RUN apt-get update -y \ + && apt-get install -y software-properties-common \ + && add-apt-repository -y ppa:git-core/ppa \ + && apt-get update -y \ + && apt-get install -y --no-install-recommends \ + curl \ + ca-certificates \ + git \ + iproute2 \ + iptables \ + jq \ + sudo \ + uidmap \ + unzip \ + zip \ + fuse-overlayfs \ + && rm -rf /var/lib/apt/lists/* + +# Download latest git-lfs version +RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \ + apt-get install -y --no-install-recommends git-lfs + +# Runner user +RUN adduser --disabled-password --gecos "" --uid $RUNNER_USER_UID runner + +ENV HOME=/home/runner + +# Set-up subuid and subgid so that "--userns-remap=default" works +RUN set -eux; \ + addgroup --system dockremap; \ + adduser --system --ingroup dockremap dockremap; \ + echo 'dockremap:165536:65536' >> /etc/subuid; \ + echo 'dockremap:165536:65536' >> /etc/subgid + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \ + && chmod +x /usr/bin/dumb-init + +ENV RUNNER_ASSETS_DIR=/runnertmp +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \ + && mkdir -p "$RUNNER_ASSETS_DIR" \ + && cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \ + && tar xzf ./runner.tar.gz \ + && rm runner.tar.gz \ + && ./bin/installdependencies.sh \ + && mv ./externals ./externalstmp \ + # libyaml-dev is required for ruby/setup-ruby action. + # It is installed after installdependencies.sh and before removing /var/lib/apt/lists + # to avoid rerunning apt-update on its own. + && apt-get install -y libyaml-dev \ + && rm -rf /var/lib/apt/lists/* + +ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache +RUN mkdir /opt/hostedtoolcache \ + && chgrp runner /opt/hostedtoolcache \ + && chmod g+rwx /opt/hostedtoolcache + +RUN cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \ + && unzip ./runner-container-hooks.zip -d ./k8s \ + && rm -f runner-container-hooks.zip + +# Make the rootless runner directory executable +RUN mkdir /run/user/1000 \ + && chown runner:runner /run/user/1000 \ + && chmod a+x /run/user/1000 + +# We place the scripts in `/usr/bin` so that users who extend this image can +# override them with scripts of the same name placed in `/usr/local/bin`. +COPY entrypoint-dind-rootless.sh startup.sh logger.sh graceful-stop.sh update-status /usr/bin/ +RUN chmod +x /usr/bin/entrypoint-dind-rootless.sh /usr/bin/startup.sh + +# Copy the docker shim which propagates the docker MTU to underlying networks +# to replace the docker binary in the PATH. +COPY docker-shim.sh /usr/local/bin/docker + +# Configure hooks folder structure. +COPY hooks /etc/arc/hooks/ + +# Add the Python "User Script Directory" to the PATH +ENV PATH="${PATH}:${HOME}/.local/bin:/home/runner/bin" +ENV ImageOS=ubuntu22 +ENV DOCKER_HOST=unix:///run/user/1000/docker.sock +ENV XDG_RUNTIME_DIR=/run/user/1000 + +RUN echo "PATH=${PATH}" > /etc/environment \ + && echo "ImageOS=${ImageOS}" >> /etc/environment \ + && echo "DOCKER_HOST=${DOCKER_HOST}" >> /etc/environment \ + && echo "XDG_RUNTIME_DIR=${XDG_RUNTIME_DIR}" >> /etc/environment + +# No group definition, as that makes it harder to run docker. +USER runner + +# This will install docker under $HOME/bin according to the content of the script +RUN export SKIP_IPTABLES=1 \ + && curl -fsSL https://get.docker.com/rootless | sh \ + && /home/runner/bin/docker -v + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && mkdir -p /home/runner/.docker/cli-plugins \ + && curl -fLo /home/runner/.docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \ + && chmod +x /home/runner/.docker/cli-plugins/docker-compose \ + && ln -s /home/runner/.docker/cli-plugins/docker-compose /home/runner/bin/docker-compose \ + && which docker-compose \ + && docker compose version + +# Create folder structure here to avoid permission issues +# when mounting the daemon.json file from a configmap. +RUN mkdir -p /home/runner/.config/docker + +ENTRYPOINT ["/bin/bash", "-c"] +CMD ["entrypoint-dind-rootless.sh"] diff --git a/legacy/runner/actions-runner-dind.ubuntu-20.04.dockerfile b/legacy/runner/actions-runner-dind.ubuntu-20.04.dockerfile new file mode 100644 index 0000000..5213004 --- /dev/null +++ b/legacy/runner/actions-runner-dind.ubuntu-20.04.dockerfile @@ -0,0 +1,144 @@ +FROM ubuntu:20.04 + +ARG TARGETPLATFORM +ARG RUNNER_VERSION +ARG RUNNER_CONTAINER_HOOKS_VERSION +# Docker and Docker Compose arguments +ARG CHANNEL=stable +ARG DOCKER_VERSION=24.0.7 +ARG DOCKER_COMPOSE_VERSION=v2.23.0 +ARG DUMB_INIT_VERSION=1.2.5 + +# Use 1001 and 121 for compatibility with GitHub-hosted runners +ARG RUNNER_UID=1000 +ARG DOCKER_GID=1001 + +ENV DEBIAN_FRONTEND=noninteractive +RUN apt-get update -y \ + && apt-get install -y software-properties-common \ + && add-apt-repository -y ppa:git-core/ppa \ + && apt-get update -y \ + && apt-get install -y --no-install-recommends \ + build-essential \ + curl \ + ca-certificates \ + dnsutils \ + ftp \ + git \ + iproute2 \ + iputils-ping \ + iptables \ + jq \ + libunwind8 \ + locales \ + netcat \ + net-tools \ + openssh-client \ + parallel \ + python3-pip \ + rsync \ + shellcheck \ + software-properties-common \ + sudo \ + telnet \ + time \ + tzdata \ + unzip \ + upx \ + wget \ + zip \ + zstd \ + && ln -sf /usr/bin/python3 /usr/bin/python \ + && ln -sf /usr/bin/pip3 /usr/bin/pip \ + && rm -rf /var/lib/apt/lists/* + +# Download latest git-lfs version +RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \ + apt-get install -y --no-install-recommends git-lfs + +# Runner user +RUN adduser --disabled-password --gecos "" --uid $RUNNER_UID runner \ + && groupadd docker --gid $DOCKER_GID \ + && usermod -aG sudo runner \ + && usermod -aG docker runner \ + && echo "%sudo ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \ + && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers + +ENV HOME=/home/runner + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \ + && chmod +x /usr/bin/dumb-init + +ENV RUNNER_ASSETS_DIR=/runnertmp +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \ + && mkdir -p "$RUNNER_ASSETS_DIR" \ + && cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \ + && tar xzf ./runner.tar.gz \ + && rm -f runner.tar.gz \ + && ./bin/installdependencies.sh \ + # libyaml-dev is required for ruby/setup-ruby action. + # It is installed after installdependencies.sh and before removing /var/lib/apt/lists + # to avoid rerunning apt-update on its own. + && apt-get install -y libyaml-dev \ + && rm -rf /var/lib/apt/lists/* + +ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache +RUN mkdir /opt/hostedtoolcache \ + && chgrp docker /opt/hostedtoolcache \ + && chmod g+rwx /opt/hostedtoolcache + +RUN cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \ + && unzip ./runner-container-hooks.zip -d ./k8s \ + && rm -f runner-container-hooks.zip + +RUN set -vx; \ + export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo docker.tgz https://download.docker.com/linux/static/${CHANNEL}/${ARCH}/docker-${DOCKER_VERSION}.tgz \ + && tar zxvf docker.tgz \ + && install -o root -g root -m 755 docker/* /usr/bin/ \ + && rm -rf docker docker.tgz + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && mkdir -p /usr/libexec/docker/cli-plugins \ + && curl -fLo /usr/libexec/docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \ + && chmod +x /usr/libexec/docker/cli-plugins/docker-compose \ + && ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose \ + && which docker-compose \ + && docker compose version + +# We place the scripts in `/usr/bin` so that users who extend this image can +# override them with scripts of the same name placed in `/usr/local/bin`. +COPY entrypoint-dind.sh startup.sh logger.sh wait.sh graceful-stop.sh update-status /usr/bin/ +RUN chmod +x /usr/bin/entrypoint-dind.sh /usr/bin/startup.sh + +# Copy the docker shim which propagates the docker MTU to underlying networks +# to replace the docker binary in the PATH. +COPY docker-shim.sh /usr/local/bin/docker + +# Configure hooks folder structure. +COPY hooks /etc/arc/hooks/ + +VOLUME /var/lib/docker + +# Add the Python "User Script Directory" to the PATH +ENV PATH="${PATH}:${HOME}/.local/bin" +ENV ImageOS=ubuntu20 + +RUN echo "PATH=${PATH}" > /etc/environment \ + && echo "ImageOS=${ImageOS}" >> /etc/environment + +# No group definition, as that makes it harder to run docker. +USER runner + +ENTRYPOINT ["/bin/bash", "-c"] +CMD ["entrypoint-dind.sh"] diff --git a/legacy/runner/actions-runner-dind.ubuntu-22.04.dockerfile b/legacy/runner/actions-runner-dind.ubuntu-22.04.dockerfile new file mode 100644 index 0000000..9e9ec86 --- /dev/null +++ b/legacy/runner/actions-runner-dind.ubuntu-22.04.dockerfile @@ -0,0 +1,120 @@ +FROM ubuntu:22.04 + +ARG TARGETPLATFORM +ARG RUNNER_VERSION +ARG RUNNER_CONTAINER_HOOKS_VERSION +# Docker and Docker Compose arguments +ARG CHANNEL=stable +ARG DOCKER_VERSION=24.0.7 +ARG DOCKER_COMPOSE_VERSION=v2.23.0 +ARG DUMB_INIT_VERSION=1.2.5 +ARG RUNNER_USER_UID=1001 +ARG DOCKER_GROUP_GID=121 + +ENV DEBIAN_FRONTEND=noninteractive +RUN apt-get update -y \ + && apt-get install -y software-properties-common \ + && add-apt-repository -y ppa:git-core/ppa \ + && apt-get update -y \ + && apt-get install -y --no-install-recommends \ + curl \ + ca-certificates \ + git \ + iptables \ + jq \ + software-properties-common \ + sudo \ + unzip \ + zip \ + && rm -rf /var/lib/apt/lists/* + +# Download latest git-lfs version +RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \ + apt-get install -y --no-install-recommends git-lfs + +# Runner user +RUN adduser --disabled-password --gecos "" --uid $RUNNER_USER_UID runner \ + && groupadd docker --gid $DOCKER_GROUP_GID \ + && usermod -aG sudo runner \ + && usermod -aG docker runner \ + && echo "%sudo ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \ + && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers + +ENV HOME=/home/runner + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \ + && chmod +x /usr/bin/dumb-init + +ENV RUNNER_ASSETS_DIR=/runnertmp +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \ + && mkdir -p "$RUNNER_ASSETS_DIR" \ + && cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \ + && tar xzf ./runner.tar.gz \ + && rm -f runner.tar.gz \ + && ./bin/installdependencies.sh \ + # libyaml-dev is required for ruby/setup-ruby action. + # It is installed after installdependencies.sh and before removing /var/lib/apt/lists + # to avoid rerunning apt-update on its own. + && apt-get install -y libyaml-dev \ + && rm -rf /var/lib/apt/lists/* + +ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache +RUN mkdir /opt/hostedtoolcache \ + && chgrp docker /opt/hostedtoolcache \ + && chmod g+rwx /opt/hostedtoolcache + +RUN cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \ + && unzip ./runner-container-hooks.zip -d ./k8s \ + && rm -f runner-container-hooks.zip + +RUN set -vx; \ + export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo docker.tgz https://download.docker.com/linux/static/${CHANNEL}/${ARCH}/docker-${DOCKER_VERSION}.tgz \ + && tar zxvf docker.tgz \ + && install -o root -g root -m 755 docker/* /usr/bin/ \ + && rm -rf docker docker.tgz + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && mkdir -p /usr/libexec/docker/cli-plugins \ + && curl -fLo /usr/libexec/docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \ + && chmod +x /usr/libexec/docker/cli-plugins/docker-compose \ + && ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose \ + && which docker-compose \ + && docker compose version + +# We place the scripts in `/usr/bin` so that users who extend this image can +# override them with scripts of the same name placed in `/usr/local/bin`. +COPY entrypoint-dind.sh startup.sh logger.sh wait.sh graceful-stop.sh update-status /usr/bin/ +RUN chmod +x /usr/bin/entrypoint-dind.sh /usr/bin/startup.sh + +# Copy the docker shim which propagates the docker MTU to underlying networks +# to replace the docker binary in the PATH. +COPY docker-shim.sh /usr/local/bin/docker + +# Configure hooks folder structure. +COPY hooks /etc/arc/hooks/ + +VOLUME /var/lib/docker + +# Add the Python "User Script Directory" to the PATH +ENV PATH="${PATH}:${HOME}/.local/bin" +ENV ImageOS=ubuntu22 + +RUN echo "PATH=${PATH}" > /etc/environment \ + && echo "ImageOS=${ImageOS}" >> /etc/environment + +# No group definition, as that makes it harder to run docker. +USER runner + +ENTRYPOINT ["/bin/bash", "-c"] +CMD ["entrypoint-dind.sh"] diff --git a/legacy/runner/actions-runner.ubuntu-20.04.dockerfile b/legacy/runner/actions-runner.ubuntu-20.04.dockerfile new file mode 100644 index 0000000..142ca3a --- /dev/null +++ b/legacy/runner/actions-runner.ubuntu-20.04.dockerfile @@ -0,0 +1,137 @@ +FROM ubuntu:20.04 + +ARG TARGETPLATFORM +ARG RUNNER_VERSION +ARG RUNNER_CONTAINER_HOOKS_VERSION +# Docker and Docker Compose arguments +ARG CHANNEL=stable +ARG DOCKER_VERSION=24.0.7 +ARG DOCKER_COMPOSE_VERSION=v2.23.0 +ARG DUMB_INIT_VERSION=1.2.5 + +# Use 1001 and 121 for compatibility with GitHub-hosted runners +ARG RUNNER_UID=1000 +ARG DOCKER_GID=1001 + +ENV DEBIAN_FRONTEND=noninteractive +RUN apt-get update -y \ + && apt-get install -y software-properties-common \ + && add-apt-repository -y ppa:git-core/ppa \ + && apt-get update -y \ + && apt-get install -y --no-install-recommends \ + build-essential \ + curl \ + ca-certificates \ + dnsutils \ + ftp \ + git \ + iproute2 \ + iputils-ping \ + jq \ + libunwind8 \ + locales \ + netcat \ + openssh-client \ + parallel \ + python3-pip \ + rsync \ + shellcheck \ + sudo \ + telnet \ + time \ + tzdata \ + unzip \ + upx \ + wget \ + zip \ + zstd \ + && ln -sf /usr/bin/python3 /usr/bin/python \ + && ln -sf /usr/bin/pip3 /usr/bin/pip \ + && rm -rf /var/lib/apt/lists/* + +# Download latest git-lfs version +RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \ + apt-get install -y --no-install-recommends git-lfs + +RUN adduser --disabled-password --gecos "" --uid $RUNNER_UID runner \ + && groupadd docker --gid $DOCKER_GID \ + && usermod -aG sudo runner \ + && usermod -aG docker runner \ + && echo "%sudo ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \ + && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers + +ENV HOME=/home/runner + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \ + && chmod +x /usr/bin/dumb-init + +ENV RUNNER_ASSETS_DIR=/runnertmp +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \ + && mkdir -p "$RUNNER_ASSETS_DIR" \ + && cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \ + && tar xzf ./runner.tar.gz \ + && rm runner.tar.gz \ + && ./bin/installdependencies.sh \ + && mv ./externals ./externalstmp \ + # libyaml-dev is required for ruby/setup-ruby action. + # It is installed after installdependencies.sh and before removing /var/lib/apt/lists + # to avoid rerunning apt-update on its own. + && apt-get install -y libyaml-dev \ + && rm -rf /var/lib/apt/lists/* + +ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache +RUN mkdir /opt/hostedtoolcache \ + && chgrp docker /opt/hostedtoolcache \ + && chmod g+rwx /opt/hostedtoolcache + +RUN cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \ + && unzip ./runner-container-hooks.zip -d ./k8s \ + && rm -f runner-container-hooks.zip + +RUN set -vx; \ + export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo docker.tgz https://download.docker.com/linux/static/${CHANNEL}/${ARCH}/docker-${DOCKER_VERSION}.tgz \ + && tar zxvf docker.tgz \ + && install -o root -g root -m 755 docker/docker /usr/bin/docker \ + && rm -rf docker docker.tgz + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && mkdir -p /usr/libexec/docker/cli-plugins \ + && curl -fLo /usr/libexec/docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \ + && chmod +x /usr/libexec/docker/cli-plugins/docker-compose \ + && ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose \ + && which docker-compose \ + && docker compose version + +# We place the scripts in `/usr/bin` so that users who extend this image can +# override them with scripts of the same name placed in `/usr/local/bin`. +COPY entrypoint.sh startup.sh logger.sh graceful-stop.sh update-status /usr/bin/ + +# Copy the docker shim which propagates the docker MTU to underlying networks +# to replace the docker binary in the PATH. +COPY docker-shim.sh /usr/local/bin/docker + +# Configure hooks folder structure. +COPY hooks /etc/arc/hooks/ + +# Add the Python "User Script Directory" to the PATH +ENV PATH="${PATH}:${HOME}/.local/bin/" +ENV ImageOS=ubuntu20 + +RUN echo "PATH=${PATH}" > /etc/environment \ + && echo "ImageOS=${ImageOS}" >> /etc/environment + +USER runner + +ENTRYPOINT ["/bin/bash", "-c"] +CMD ["entrypoint.sh"] diff --git a/legacy/runner/actions-runner.ubuntu-22.04.dockerfile b/legacy/runner/actions-runner.ubuntu-22.04.dockerfile new file mode 100644 index 0000000..a8d31e3 --- /dev/null +++ b/legacy/runner/actions-runner.ubuntu-22.04.dockerfile @@ -0,0 +1,114 @@ +FROM ubuntu:22.04 + +ARG TARGETPLATFORM +ARG RUNNER_VERSION +ARG RUNNER_CONTAINER_HOOKS_VERSION +# Docker and Docker Compose arguments +ARG CHANNEL=stable +ARG DOCKER_VERSION=24.0.7 +ARG DOCKER_COMPOSE_VERSION=v2.23.0 +ARG DUMB_INIT_VERSION=1.2.5 +ARG RUNNER_USER_UID=1001 +ARG DOCKER_GROUP_GID=121 + +ENV DEBIAN_FRONTEND=noninteractive +RUN apt-get update -y \ + && apt-get install -y software-properties-common \ + && add-apt-repository -y ppa:git-core/ppa \ + && apt-get update -y \ + && apt-get install -y --no-install-recommends \ + curl \ + ca-certificates \ + git \ + jq \ + sudo \ + unzip \ + zip \ + && rm -rf /var/lib/apt/lists/* + +# Download latest git-lfs version +RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \ + apt-get install -y --no-install-recommends git-lfs + +RUN adduser --disabled-password --gecos "" --uid $RUNNER_USER_UID runner \ + && groupadd docker --gid $DOCKER_GROUP_GID \ + && usermod -aG sudo runner \ + && usermod -aG docker runner \ + && echo "%sudo ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \ + && echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers + +ENV HOME=/home/runner + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \ + && chmod +x /usr/bin/dumb-init + +ENV RUNNER_ASSETS_DIR=/runnertmp +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \ + && mkdir -p "$RUNNER_ASSETS_DIR" \ + && cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \ + && tar xzf ./runner.tar.gz \ + && rm runner.tar.gz \ + && ./bin/installdependencies.sh \ + && mv ./externals ./externalstmp \ + # libyaml-dev is required for ruby/setup-ruby action. + # It is installed after installdependencies.sh and before removing /var/lib/apt/lists + # to avoid rerunning apt-update on its own. + && apt-get install -y libyaml-dev \ + && rm -rf /var/lib/apt/lists/* + +ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache +RUN mkdir /opt/hostedtoolcache \ + && chgrp docker /opt/hostedtoolcache \ + && chmod g+rwx /opt/hostedtoolcache + +RUN cd "$RUNNER_ASSETS_DIR" \ + && curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \ + && unzip ./runner-container-hooks.zip -d ./k8s \ + && rm -f runner-container-hooks.zip + +RUN set -vx; \ + export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && curl -fLo docker.tgz https://download.docker.com/linux/static/${CHANNEL}/${ARCH}/docker-${DOCKER_VERSION}.tgz \ + && tar zxvf docker.tgz \ + && install -o root -g root -m 755 docker/docker /usr/bin/docker \ + && rm -rf docker docker.tgz + +RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \ + && if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \ + && if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \ + && mkdir -p /usr/libexec/docker/cli-plugins \ + && curl -fLo /usr/libexec/docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \ + && chmod +x /usr/libexec/docker/cli-plugins/docker-compose \ + && ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose \ + && which docker-compose \ + && docker compose version + +# We place the scripts in `/usr/bin` so that users who extend this image can +# override them with scripts of the same name placed in `/usr/local/bin`. +COPY entrypoint.sh startup.sh logger.sh graceful-stop.sh update-status /usr/bin/ + +# Copy the docker shim which propagates the docker MTU to underlying networks +# to replace the docker binary in the PATH. +COPY docker-shim.sh /usr/local/bin/docker + +# Configure hooks folder structure. +COPY hooks /etc/arc/hooks/ + +# Add the Python "User Script Directory" to the PATH +ENV PATH="${PATH}:${HOME}/.local/bin/" +ENV ImageOS=ubuntu22 + +RUN echo "PATH=${PATH}" > /etc/environment \ + && echo "ImageOS=${ImageOS}" >> /etc/environment + +USER runner + +ENTRYPOINT ["/bin/bash", "-c"] +CMD ["entrypoint.sh"] diff --git a/legacy/runner/docker-shim.sh b/legacy/runner/docker-shim.sh new file mode 100755 index 0000000..21378dd --- /dev/null +++ b/legacy/runner/docker-shim.sh @@ -0,0 +1,17 @@ +#!/usr/bin/env bash + +set -Eeuo pipefail + +DOCKER=/usr/bin/docker +if [ ! -e $DOCKER ]; then + DOCKER=/home/runner/bin/docker +fi + +if [[ ${ARC_DOCKER_MTU_PROPAGATION:-false} == true ]] && + (($# >= 2)) && [[ $1 == network && $2 == create ]] && + mtu=$($DOCKER network inspect bridge --format '{{index .Options "com.docker.network.driver.mtu"}}' 2>/dev/null); then + shift 2 + set -- network create --opt com.docker.network.driver.mtu="$mtu" "$@" +fi + +exec $DOCKER "$@" diff --git a/legacy/runner/entrypoint-dind-rootless.sh b/legacy/runner/entrypoint-dind-rootless.sh new file mode 100644 index 0000000..9c8cc01 --- /dev/null +++ b/legacy/runner/entrypoint-dind-rootless.sh @@ -0,0 +1,56 @@ +#!/bin/bash +source logger.sh +source graceful-stop.sh +trap graceful_stop TERM + +log.notice "Writing out Docker config file" +/bin/bash <