Commit 3baebeeec5
3baebeeec5fdadb510669b9dae32dc9b80ca6fd3
parent: 4effb29e57
Verified · cmc ci/build: success ci/test: success
cmc <hello@cleberg.net> · 2026-09-10 02:28 UTC
deploy, ci: gitbay-ci:2 carries python3-venv
The image is also the default for every repository the bay1 runner is
attached to; a lint job that makes a venv for ruff failed on a missing
ensurepip. Every reference moves to the new tag.
Ref #184
.gitbay/ci.yml
+4 −4
| @@ -2,7 +2,7 @@ jobs: |
| 2 | 2 | # Fast feedback: this finishes in seconds, so it is not held behind the |
| 3 | 3 | # suite. |
| 4 | 4 | build: |
| 5 | | image: localhost/gitbay-ci:1 |
| 5 | image: localhost/gitbay-ci:2 |
| 6 | 6 | steps: |
| 7 | 7 | - go build ./... |
| 8 | 8 | - go vet ./... |
| @@ -13,7 +13,7 @@ jobs: |
| 13 | 13 | # The 20m is under the runner's own 30m limit, so go times out first and |
| 14 | 14 | # says which test hung instead of the runner killing it blind. |
| 15 | 15 | test: |
| 16 | | image: localhost/gitbay-ci:1 |
| 16 | image: localhost/gitbay-ci:2 |
| 17 | 17 | steps: |
| 18 | 18 | - missing=""; for t in git git-lfs gpg; do command -v "$t" >/dev/null || missing="$missing $t"; done; test -x /usr/sbin/sshd || missing="$missing sshd"; test -z "$missing" || { echo "runner is missing:$missing"; exit 1; } |
| 19 | 19 | - go test ./... -count=1 -timeout 20m |
| @@ -33,7 +33,7 @@ jobs: |
| 33 | 33 | # `build trigger krz/gitbay vuln` runs it on demand before a release |
| 34 | 34 | # (#177). |
| 35 | 35 | vuln: |
| 36 | | image: localhost/gitbay-ci:1 |
| 36 | image: localhost/gitbay-ci:2 |
| 37 | 37 | schedule: "0 3 * * *" |
| 38 | 38 | steps: |
| 39 | 39 | - go run golang.org/x/vuln/cmd/govulncheck@latest ./... |
| @@ -56,7 +56,7 @@ jobs: |
| 56 | 56 | # linux-x64 bundle carries its own JRE, which is why the host needs no |
| 57 | 57 | # Java. |
| 58 | 58 | sonar: |
| 59 | | image: localhost/gitbay-ci:1 |
| 59 | image: localhost/gitbay-ci:2 |
| 60 | 60 | schedule: "30 3 * * *" |
| 61 | 61 | steps: |
| 62 | 62 | - | |
.gitbay/wiki/Admin.org
+2 −2
| @@ -458,7 +458,7 @@ where every repository is trusted. There is no automatic fallback: a |
| 458 | 458 | runner started with =-isolation podman= that cannot find a working |
| 459 | 459 | podman exits rather than running a build unsandboxed. |
| 460 | 460 | |
| 461 | | gitbay's own jobs name =localhost/gitbay-ci:1=, built from |
| 461 | gitbay's own jobs name =localhost/gitbay-ci:2=, built from |
| 462 | 462 | =deploy/Containerfile.ci= on the runner host. A job's image must carry |
| 463 | 463 | what its steps need: the suite drives real git, git-lfs, gpg and sshd and |
| 464 | 464 | asserts they exist before running, so the stock runner default would fail |
| @@ -467,7 +467,7 @@ it immediately. Build or rebuild it with: |
| 467 | 467 | #+begin_src sh |
| 468 | 468 | ssh -p 2222 root@<host> 'cat > /tmp/Containerfile.ci' < deploy/Containerfile.ci |
| 469 | 469 | ssh -p 2222 root@<host> 'su - ci-runner -s /bin/sh -c \ |
| 470 | | "podman build -t localhost/gitbay-ci:1 -f /tmp/Containerfile.ci /tmp"' |
| 470 | "podman build -t localhost/gitbay-ci:2 -f /tmp/Containerfile.ci /tmp"' |
| 471 | 471 | #+end_src |
| 472 | 472 | |
| 473 | 473 | The tag is deliberate rather than =:latest=: changing the file means |
deploy/Containerfile.ci
+6 −1
| @@ -5,7 +5,7 @@ |
| 5 | 5 | # Build it on the runner host, where podman keeps it: |
| 6 | 6 | # |
| 7 | 7 | # ssh -p 2222 root@bay1 'su - ci-runner -s /bin/sh -c \ |
| 8 | | # "podman build -t localhost/gitbay-ci:1 -f - ." ' < deploy/Containerfile.ci |
| 8 | # "podman build -t localhost/gitbay-ci:2 -f - ." ' < deploy/Containerfile.ci |
| 9 | 9 | # |
| 10 | 10 | # Tagged, not :latest, so a change to this file is a deliberate bump in |
| 11 | 11 | # .gitbay/ci.yml rather than a silent change under a running branch. |
| @@ -14,6 +14,9 @@ FROM docker.io/library/golang:1.27-trixie |
| 14 | 14 | # The suite drives real git, ssh, sshd and gpg rather than mocking them, |
| 15 | 15 | # and asserts they are present before running. git-lfs has its own tests; |
| 16 | 16 | # sshd must be the binary at /usr/sbin/sshd that the tests exec. |
| 17 | # python3-venv: this is also the default image for every repository the |
| 18 | # bay1 runner is attached to, and a lint job that makes a venv for ruff |
| 19 | # fails without ensurepip (gitbay-ci:2). |
| 17 | 20 | RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \ |
| 18 | 21 | git-lfs \ |
| 19 | 22 | gnupg \ |
| @@ -22,6 +25,8 @@ RUN apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-ins |
| 22 | 25 | ca-certificates \ |
| 23 | 26 | curl \ |
| 24 | 27 | unzip \ |
| 28 | python3 \ |
| 29 | python3-venv \ |
| 25 | 30 | && rm -rf /var/lib/apt/lists/* |
| 26 | 31 | |
| 27 | 32 | # A build runs as this image's root inside its own user namespace, mapped |
deploy/gitbay-runner.override.conf
+1 −1
| @@ -75,7 +75,7 @@ KillMode=mixed |
| 75 | 75 | # -untrusted: this runner isolates in podman, so it takes merge request |
| 76 | 76 | # heads from forks; a runner without a container must not. |
| 77 | 77 | ExecStart= |
| 78 | | ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:1 -cpus 3 -memory 6g -untrusted |
| 78 | ExecStart=/usr/local/bin/gitbay-runner -remote git@127.0.0.1 -workdir /var/lib/gitbay-runner/work -poll 5s -timeout 45m -isolation podman -image localhost/gitbay-ci:2 -cpus 3 -memory 6g -untrusted |
| 79 | 79 | Nice=10 |
| 80 | 80 | CPUWeight=30 |
| 81 | 81 | IOWeight=30 |
e2e/isolation_podman_test.go
+3 −3
| @@ -17,13 +17,13 @@ import ( |
| 17 | 17 | // same rule builds follow. |
| 18 | 18 | func provisionedImage(t *testing.T) string { |
| 19 | 19 | t.Helper() |
| 20 | | for _, img := range []string{"localhost/gitbay-ci:1", "docker.io/library/debian:stable-slim", "docker.io/library/alpine:latest"} { |
| 20 | for _, img := range []string{"localhost/gitbay-ci:2", "docker.io/library/debian:stable-slim", "docker.io/library/alpine:latest"} { |
| 21 | 21 | if err := exec.Command("podman", "image", "exists", img).Run(); err == nil { |
| 22 | 22 | return img |
| 23 | 23 | } |
| 24 | 24 | } |
| 25 | 25 | t.Log("SKIPPING ISOLATION TEST: podman has no image this test can use. " + |
| 26 | | "Provision one (podman build -t localhost/gitbay-ci:1 -f deploy/Containerfile.ci). " + |
| 26 | "Provision one (podman build -t localhost/gitbay-ci:2 -f deploy/Containerfile.ci). " + |
| 27 | 27 | "The container path is NOT covered by this run.") |
| 28 | 28 | return "" |
| 29 | 29 | } |
| @@ -179,7 +179,7 @@ func runnerPodmanOnce(t *testing.T, inst *instance, key string) { |
| 179 | 179 | "-remote", "git@127.0.0.1", |
| 180 | 180 | "-ssh-opts", opts, |
| 181 | 181 | "-isolation", "podman", |
| 182 | | "-image", "localhost/gitbay-ci:1", |
| 182 | "-image", "localhost/gitbay-ci:2", |
| 183 | 183 | "-clone-base", fmt.Sprintf("ssh://git@127.0.0.1:%d", inst.port), |
| 184 | 184 | "-workdir", t.TempDir()) |
| 185 | 185 | cmd.Env = append(os.Environ(), "XDG_CONFIG_HOME="+t.TempDir(), "GIT_CONFIG_NOSYSTEM=1", "GIT_CONFIG_GLOBAL=/dev/null") |