3 ms·

I have a setup on a Pi for deploying progscrape.com that has a systemd task to boot a new runner in a container. I really need to turn it into a bare-metal depl

I have a setup on a Pi for deploying progscrape.com that has a systemd task to boot a new runner in a container. I really need to turn it into a bare-metal deployment script so I can recover from an SD card crash. Basically this service: [Unit] Description=%N Container After=docker.service Requires=docker.service [Service] TimeoutSec=3600 Restart=always WorkingDirectory=/srv/progscrape/progscrape-deploy/github-runners ExecStartPre=-/usr/bin/docker compose -f %N.yml -p %N stop ExecStartPre=-/usr/bin/docker compose -f %N.yml -p %N pull ExecStart=/usr/bin/docker compose -f %N.yml -p %N up ExecStopPost=-/usr/bin/docker compose -f %N.yml -p %N rm -f [Install] WantedBy=multi-user.target Boots this docker compose definition: services: github-docker-runner: image: myoung34/github-runner:latest restart: "no" environment: RUNNER_NAME: progscrape-docker-compose RUNNER_WORKDIR: /tmp/work EPHEMERAL: 1 LABELS: management,linux,ARM64 DISABLE_AUTO_UPDATE: 1 env_file: - github-runner.env configs: - github-runner-start entrypoint: /bin/sh command: /github-runner-start security_opt: # needed on SELinux systems to allow docker container to manage other docker containers - label:disable volumes: - '/var/run/docker.sock:/var/run/docker.sock' configs: github-runner-start: file: runner-start.sh

znpy 3y ago
volumes: - '/var/run/docker.sock:/var/run/docker.sock' The good old docker security nightmare. That thing has essentially root access to your machine. Just so you know. You might want to move to Podman (which can be executed in rootless mode) so that you can also run podman-in-podman without much hassle (it's officially supported afaik).
- Belphemur 3y ago
  Or follow the doc on running docker rootless: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ But in any case I think it's always better to do docker in docker for security. Also it help control what version of docker is used by the agent and it can then be a different one than the one on the host.

znpy 3y ago

volumes: - '/var/run/docker.sock:/var/run/docker.sock' The good old docker security nightmare. That thing has essentially root access to your machine. Just so you know. You might want to move to Podman (which can be executed in rootless mode) so that you can also run podman-in-podman without much hassle (it's officially supported afaik).

Belphemur 3y ago
Or follow the doc on running docker rootless: https://docs.docker.com/engine/security/rootless/ https://docs.docker.com/engine/security/rootless/ But in any case I think it's always better to do docker in docker for security. Also it help control what version of docker is used by the agent and it can then be a different one than the one on the host.