deploy/gitbay-runner.override.conf

 1# Drop-in for gitbay-runner.service, installed by `make deploy-runner` to
 2# /etc/systemd/system/gitbay-runner.service.d/override.conf.
 3#
 4# A build must never starve the host: the e2e suite alone starts sixty
 5# daemon instances, and with nothing holding it back a deploy's scp on
 6# the admin sshd stalled at 1%. Lower CPU and IO weight keep sshd,
 7# gitbayd and the backup timers responsive while a build runs.
 8#
 9# These weights are for the service, not per build, so `-jobs N` divides
10# them among N builds rather than taking N times as much. Raising -jobs
11# does not need them raised; it makes each build slower, not the host
12# busier.
13#
14# A build runs whatever the repository's ci.yml says, as the runner's
15# own user. Keep that user unprivileged: its key is added with
16# `keys add --scope runner`, which confines it to the runner protocol
17# and read-only git, and the sandboxing below keeps a step from
18# touching the system outside its workspace.
19#
20# Delegate=yes and the storage path below are what rootless podman needs
21# (#144): it manages its own cgroups for a container, and its image and
22# container store lives under the runner's home, which ProtectSystem
23# would otherwise make read-only. Prepare the host with
24# deploy/runner-podman-setup.sh before deploying a runner that isolates.
25[Service]
26Nice=10
27CPUWeight=30
28IOWeight=30
29NoNewPrivileges=yes
30ProtectSystem=full
31ProtectKernelTunables=yes
32ProtectControlGroups=yes
33RestrictSUIDSGID=yes
34Delegate=yes
35# The runner's home is /var/lib/gitbay-runner (see the Admin page), and
36# the leading - makes a missing path ignored rather than fatal: this
37# drop-in installs on hosts that have not been prepared for podman yet,
38# and a unit that refuses to start would stop every build on the
39# instance.
40ReadWritePaths=-/var/lib/gitbay-runner/.local/share/containers -/var/lib/gitbay-runner/.config/containers