Commit `3d2795d9c2`

3d2795d9c21003fe57a3d32525892b59dc159b09

parent: 537b85aba4

Verified · cmc ci/build: success ci/test: success

cmc <hello@cleberg.net> · 2026-09-06 21:46 UTC

runner, wiki: give builds a home that outlives the build

HOME was the per-build workspace, which run() deletes when the build
ends, so every build re-downloaded the Go module cache and the sonar
scanner. It is now a directory beside the workspaces: persistent, and
still not the runner's own home.

Ref #144

Layout: unified · split

.gitbay/wiki/Threat-Model.org +7 −3

   no secrets, so a stranger's branch cannot read the target's deploy
   credentials. The step environment is *constructed*, not inherited: a
   build gets =PATH=, =HOME=, =LANG=, =CI=, its own variables and its
-  secrets, and nothing the operator set on the service. =HOME= is the
+  secrets, and nothing the operator set on the service. =HOME= is a build
-  workspace, so a build cannot read the runner's =.netrc=, =.npmrc= or
+  home under the runner's =-workdir=, not the runner's own home, so a
-  =.gitconfig=, where tools keep credentials.
+  build cannot read the =.netrc=, =.npmrc= or =.gitconfig= where tools
+  keep credentials. That home is shared by every build on the runner —
+  one build can poison a cache another reads, which is no more than
+  anything a step can already do as this user, and is what isolation
+  (krz/gitbay#144) is for.
 - *Where it runs.* Steps run as the runner's own user on the runner
   host, with no container; the systemd drop-in adds =NoNewPrivileges=,
   =ProtectSystem=full= and the kernel and cgroup protections. =-repos=

cmd/gitbay-runner/env_test.go +21 −7

 	t.Setenv("GITBAY_RUNNER_TOKEN", "a-secret-the-service-was-given")
 	t.Setenv("AWS_SECRET_ACCESS_KEY", "also-not-for-builds")
-	env := stepEnv(job{Repo: "alice/app", SHA: "abc", Ref: "main", Job: "test"}, "/tmp/ws")
+	env := stepEnv(job{Repo: "alice/app", SHA: "abc", Ref: "main", Job: "test"}, "/tmp/buildhome")
 	for _, e := range env {
 		if strings.HasPrefix(e, "GITBAY_RUNNER_TOKEN=") || strings.HasPrefix(e, "AWS_SECRET_ACCESS_KEY=") {
 	want := map[string]string{
 		"CI": "true", "GITBAY_REPO": "alice/app", "GITBAY_SHA": "abc",
 		"GITBAY_REF": "main", "GITBAY_JOB": "test",
-		// HOME is the workspace so a build cannot read the runner's
+		// HOME is the shared build home, not the runner's own, so a
-		// dotfiles, where tools keep credentials.
+		// build cannot read the dotfiles where tools keep credentials —
-		"HOME": "/tmp/ws",
+		// and not the workspace, which is deleted after every build,
+		// taking every tool cache with it.
+		"HOME": "/tmp/buildhome",
 	}
 	got := map[string]string{}
 	for _, e := range env {
 // Secrets are passed through when the server sent them, which it does
 // only for a trusted build.
 func TestStepEnvCarriesSecrets(t *testing.T) {
-	env := stepEnv(job{Secrets: map[string]string{"TOKEN": "s3cret"}}, "/tmp/ws")
+	env := stepEnv(job{Secrets: map[string]string{"TOKEN": "s3cret"}}, "/tmp/buildhome")
 	if !containsEnv(env, "TOKEN=s3cret") {
 		t.Error("a trusted build's secret did not reach the step")
 	}
-	env = stepEnv(job{}, "/tmp/ws")
+	env = stepEnv(job{}, "/tmp/buildhome")
 	for _, e := range env {
 		if strings.HasPrefix(e, "TOKEN=") {
 			t.Errorf("a secret appeared with none sent: %q", e)
 	old := os.Getenv("PATH")
 	os.Unsetenv("PATH")
 	defer os.Setenv("PATH", old)
-	if env := stepEnv(job{}, "/tmp/ws"); !containsEnv(env, "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin") {
+	if env := stepEnv(job{}, "/tmp/buildhome"); !containsEnv(env, "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin") {
 		t.Errorf("no PATH fallback: %v", env)
 	}
 }
 	}
 	return false
 }
+// The build home must outlive a build. It was briefly the workspace,
+// which run() removes when the build ends, so every build re-downloaded
+// the Go module cache and the ~50MB sonar scanner.
+func TestStepEnvHomeIsNotTheWorkspace(t *testing.T) {
+	env := stepEnv(job{ID: 7}, "/var/lib/gitbay-runner/work/home")
+	for _, e := range env {
+		if strings.HasPrefix(e, "HOME=") && strings.Contains(e, "build-7") {
+			t.Errorf("HOME is the per-build workspace, which is deleted after the build: %q", e)
+		}
+	}
+}

cmd/gitbay-runner/main.go +26 −7

 	dir := filepath.Join(r.workdir, fmt.Sprintf("build-%d", j.ID))
 	defer os.RemoveAll(dir)
+	// A build's HOME. Not the workspace, which is removed after every
+	// build: the Go module cache, the sonar scanner and every other tool
+	// cache live under HOME, so a per-build one re-downloads the world
+	// each time. Not the runner's own home either, where its SSH key and
+	// credential dotfiles are. A directory beside the workspaces is
+	// neither.
+	//
+	// It is shared by every build on this runner, so a step can poison a
+	// cache another repository's build will read. That is already true of
+	// anything a step can reach as this user — see the wiki's
+	// Threat-Model on the runner — and is what container isolation (#144)
+	// is for; -repos is the control until then.
+	buildHome := filepath.Join(r.workdir, "home")
+	if err := os.MkdirAll(buildHome, 0o700); err != nil {
+		log.Printf("build %d: build home: %v", j.ID, err)
+		return false
+	}
 	// One long-lived `runner log` session receives the whole stream.
 	logCmd := exec.Command(toolpath.Look("ssh"), append(r.sshOpts, r.remote, "runner", "log", fmt.Sprint(j.ID))...)
 	pipe, err := logCmd.StdinPipe()
 		}
 	}
-	env := stepEnv(j, dir)
+	env := stepEnv(j, buildHome)
 	for _, step := range j.Steps {
 		fmt.Fprintf(sink, "$ %s\n", step)
 		cmd := exec.Command(toolpath.Look("sh"), "-c", step)
 // the runner's entire environment, including anything an operator set on
 // the service (#144).
 //
-// HOME is the workspace, not the runner's home. Tools read credentials
+// HOME is a build home shared by this runner's builds, not the runner's
-// out of dotfiles — .netrc, .npmrc, .gitconfig — and a build has no
+// own: tools read credentials out of dotfiles — .netrc, .npmrc,
-// business finding the runner's. It also means a build's caches land in
+// .gitconfig — and a build has no business finding the runner's. It is
-// the workspace and go away with it.
+// not the workspace either, because the workspace is deleted after every
+// build and every tool cache lives under HOME.
 //
 // PATH is the one thing carried over: without it a step cannot find the
 // tools the host was provisioned with.
-func stepEnv(j job, dir string) []string {
+func stepEnv(j job, home string) []string {
 	path := os.Getenv("PATH")
 	if path == "" {
 		path = "/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
 	}
 	env := []string{
 		"PATH=" + path,
-		"HOME=" + dir,
+		"HOME=" + home,
 		"LANG=C.UTF-8",
 		"CI=true",
 		"GITBAY_REPO=" + j.Repo,

Commit 3d2795d9c2

Commit `3d2795d9c2`