bug: --container-daemon-socket parameter does not apply to runner #577
Labels
No labels
FreeBSD
Kind/Breaking
Kind/Bug
Kind/Chore
Kind/DependencyUpdate
Kind/Documentation
Kind/Enhancement
Kind/Feature
Kind/Security
Kind/Testing
Priority
Critical
Priority
High
Priority
Low
Priority
Medium
Reviewed
Confirmed
Reviewed
Duplicate
Reviewed
Invalid
Reviewed
Won't Fix
Status
Abandoned
Status
Blocked
Status
Need More Info
Windows
linux-powerpc64le
linux-riscv64
linux-s390x
run-end-to-end-tests
run-forgejo-tests
run-multi-platform-tests
No milestone
No assignees
4 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
forgejo/runner#577
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Can you reproduce the bug on the Forgejo test instance?
N/A
Description
Passing
--container-daemon-socketinto the./forgejo-runnerexecutable doesn't seem to affect the utilized socket. It will instead default tounix:///var/run/docker.sock, and since I'm using podman with the socket path beingunix://$XDG_RUNTIME_DIR/podman/podman.sock, it will fail. nektos/act does not have this issue. See logs for the command used to test.I've managed to make a working build for myself, however, I am very not confident it should be merged as-is, for the following reasons:
exec.go--container-daemon-socketand tried adding it back in.Looks like the env vars are mutable?I genuinely have no idea how it happened, but a
/var/lib/docker.sockwas created as a folder, which would not be a valid host. Not sure if the following code patch fordocker_socket.gowould be warranted to add, but maybe?If I could get clarification though on what should be done though, I'd be happy to create the two PRs.
The patch relies on copying the docker_socket.go from upstream into the containers repo, and copies some code from nektos/act/root.go.
runner repository Diff
I also believe passing in a
DOCKER_HOSTvia CLI doesn't do anything, but this is worth sanity-checking.Forgejo Version
N/A
Runner Version
6245f71556How are you running Forgejo?
Attempting to use forgejo-runner as a standalone CLI, to test before pushing to a Forgejo instance
How are you running the Runner?
Compiled from source, at the commit hash defined.
Logs
./forgejo-runner exec --container-daemon-socket unix://$XDG_RUNTIME_DIR/podman/podman.sockWorkflow file
No response
bug: --container-daemon-socket parameter does not apply to runnerto bug:--container-daemon-socketparameter does not apply to runnerI would not be surprised if the code handling variables overrides the parameter.
I did not look closely enough to be sure but from a distance it looks like you are on the right track. If you send a PR to fix this I'll take a closer look and this can be fixed on the next release.
Note that there are assorted tests at https://code.forgejo.org/forgejo/end-to-end/src/branch/main/actions (example-with-docker-host etc.) and one could be added to verify the argument is processed as it should. Alternatively the argument could be removed for simplification, unless it is a blocker.
@fiocobbs wrote in #577 (comment):
Just install the podman-docker package. It will provide a link reference ....
@el0n wrote in #577 (comment):
Unfortunately this doesn't "fix" the issue since podman can run in both "rootfull" and "rootless" mode. The latter the socket is located at
unix://$XDG_RUNTIME_DIR/podman/podman.sock, which for example on my machine translates tounix:///run/user/1000/podman/podman.sockwhile/var/run/docker.sockis a symlink to/run/podman/podman.sockand/run/podmanhave0700permission set which the user have no access, unless you runsudo forgejo-runner ....which any best practices will say otherwise.I would rather see a fix to use either DOCKER_HOST or DOCKER_SOCKET env variables
What matters is how it looks like in the container. Here a snippet of a user quadlet file:
Volume=%t/podman/podman.sock:/var/run/docker.sock@fiocobbs @c8h4 there are two pull requests in the same area at the moment:
They were rebased against the latest main branch today and pass tests (no big surprise 😁). I'll comment here since the review applies to both.
The logic of how the container server is determined in Forgejo runner is convoluted. And it turns out the
--container-daemon-socketdoes not do anything, because it is always overridden by the existing logic.Showcase
It still works fine with
forgejo-runner-9.0.3 exec --container-daemon-socket=/aaa --workflows /tmp/a.yml. But it breaks with:Instead of trying to fix it and since there is already a way to specify the desired value from the environment, I think the option should just be removed. The variable
DOCKER_HOSTis documented in a specific case. But it may be good to add a line about it in the help offorgejo-runner exec.What do you think?
@fiocobbs @c8h4 if you would like me to try and fix this please let me know. Otherwise it can wait until you have time. 🙏
I went ahead and did that at #1004
The scope of the proposed pull request was too wide, I'll submit another.