Commit `42d56acf6e`

42d56acf6e62f5714c9e01568bcdbaa750a60515

parent: 41f52e0d70

Verified · cmc

cmc <hello@cleberg.net> · 2026-09-07 01:26 UTC

deploy: no default sysctls in build containers

ProtectKernelTunables makes /proc/sys read-only, and podman's default
net.ipv4.ping_group_range sysctl then fails the container start. A build
has no use for ping.

Ref #144

Layout: unified · split

deploy/runner-podman-setup.sh +11

		@@ -73,6 +73,17 @@ printf '[storage]\ndriver = "overlay"\ngraphroot = "%s/.local/share/containers/s
73	73	chown "$RUNNER_USER:$RUNNER_USER" "$conf"
74	74	echo " written"
75	75
	76	# podman sets net.ipv4.ping_group_range in every container by default,
	77	# for unprivileged ping. The service runs with ProtectKernelTunables, so
	78	# /proc/sys is read-only and crun fails to start the container with
	79	# "open /proc/sys/net/ipv4/ping_group_range: Read-only file system". A
	80	# build has no use for ping; drop the default rather than the hardening.
	81	cconf="$home/.config/containers/containers.conf"
	82	echo "==> container defaults in $cconf"
	83	printf '[containers]\ndefault_sysctls = []\n' >"$cconf"
	84	chown "$RUNNER_USER:$RUNNER_USER" "$cconf"
	85	echo " written"
	86
76	87	# Lingering keeps the user's systemd session alive when nobody is logged
77	88	# in, which podman's pause process relies on.
78	89	echo "==> lingering for $RUNNER_USER"

Commit 42d56acf6e

Commit `42d56acf6e`