deploy/runner-podman-setup.sh

 1#!/bin/sh
 2# Prepare a runner host for container-isolated builds (#144).
 3#
 4# Run this on the runner host as root BEFORE deploying a gitbay-runner
 5# that requires isolation. The runner refuses to start without a working
 6# podman rather than falling back to running builds unsandboxed, so the
 7# order matters: prepare the host, then `make deploy-runner`.
 8#
 9#   ssh -p 2222 root@bay1 'sh -s' < deploy/runner-podman-setup.sh
10#
11# Idempotent: safe to re-run.
12set -eu
13
14RUNNER_USER="${RUNNER_USER:-ci-runner}"
15
16# The runner's home is wherever the account was created with; podman's
17# store lives under it and the systemd drop-in names the same path.
18
19if ! id "$RUNNER_USER" >/dev/null 2>&1; then
20    echo "no such user: $RUNNER_USER" >&2
21    exit 1
22fi
23
24echo "==> installing podman"
25if ! command -v podman >/dev/null 2>&1; then
26    apt-get update
27    DEBIAN_FRONTEND=noninteractive apt-get install -y podman uidmap
28fi
29podman --version
30
31# Rootless podman maps container uids into a range delegated to the user.
32# Without these the runner's `podman run` fails with a mapping error.
33echo "==> subuid/subgid for $RUNNER_USER"
34for f in /etc/subuid /etc/subgid; do
35    if ! grep -q "^$RUNNER_USER:" "$f" 2>/dev/null; then
36        echo "$RUNNER_USER:200000:65536" >>"$f"
37        echo "   added to $f"
38    else
39        echo "   already in $f"
40    fi
41done
42
43# User namespaces are what rootless podman is built on. Debian 13 enables
44# them by default; check rather than assume, because a build silently
45# running as the host user is exactly what this is meant to prevent.
46echo "==> kernel support"
47max_ns=$(cat /proc/sys/user/max_user_namespaces 2>/dev/null || echo 0)
48if [ "$max_ns" -lt 1 ]; then
49    echo "user namespaces are disabled (user.max_user_namespaces=$max_ns);" >&2
50    echo "rootless podman cannot work until they are enabled" >&2
51    exit 1
52fi
53echo "   max_user_namespaces=$max_ns"
54
55# podman's storage paths are pinned in storage.conf, both graphroot and
56# runroot, under the runner's home. Left to podman, the run root is
57# $XDG_RUNTIME_DIR or /tmp/storage-run-<uid>; the service runs with
58# PrivateTmp, so that is a per-instance tmpfs, and podman's pause process
59# (which the cgroupfs manager places outside the service cgroup) can
60# outlive a restart holding a dead /tmp — after which every podman
61# command, in any context, fails with "mkdir ...: no such file or
62# directory". A run root under the home directory is valid in every
63# namespace and needs neither lingering nor /tmp.
64#
65# podman records the run root at first use. Changing it later needs
66# `podman system reset --force` as the runner user and a rebuild of the
67# images; this script does not do that for you.
68home=$(getent passwd "$RUNNER_USER" | cut -d: -f6)
69conf="$home/.config/containers/storage.conf"
70echo "==> storage config in $conf"
71install -d -o "$RUNNER_USER" -g "$RUNNER_USER" -m 700 "$home/.config/containers"
72printf '[storage]\ndriver = "overlay"\ngraphroot = "%s/.local/share/containers/storage"\nrunroot = "%s/.local/share/containers/run"\n' "$home" "$home" >"$conf"
73chown "$RUNNER_USER:$RUNNER_USER" "$conf"
74echo "   written"
75
76# podman sets net.ipv4.ping_group_range in every container by default,
77# for unprivileged ping. The service runs with ProtectKernelTunables, so
78# /proc/sys is read-only and crun fails to start the container with
79# "open /proc/sys/net/ipv4/ping_group_range: Read-only file system". A
80# build has no use for ping; drop the default rather than the hardening.
81cconf="$home/.config/containers/containers.conf"
82echo "==> container defaults in $cconf"
83printf '[containers]\ndefault_sysctls = []\n' >"$cconf"
84chown "$RUNNER_USER:$RUNNER_USER" "$cconf"
85echo "   written"
86
87# Lingering keeps the user's systemd session alive when nobody is logged
88# in, which podman's pause process relies on.
89echo "==> lingering for $RUNNER_USER"
90loginctl enable-linger "$RUNNER_USER"
91
92echo "==> verifying rootless podman as $RUNNER_USER"
93# The verification fails rather than passing with || true: a host that
94# reports ready and is not is the outage this script exists to prevent.
95su - "$RUNNER_USER" -s /bin/sh -c "podman info --format 'rootless={{.Host.Security.Rootless}} runroot={{.Store.RunRoot}}'"
96
97echo
98echo "host is ready. Build the CI image (deploy/Containerfile.ci), then: make deploy-runner"