halkyon-days/halkyon
Watch
1
0
Fork
You've already forked halkyon
 0
Code Issues Pull requests Projects Releases 37 Packages Wiki Activity Actions 1

ci: stop a job whose sandbox leaks, first thing
Some checks failed
CI / check (push) Failing after 2m27s
Details
CI / deploy (push) Has been skipped
Details

Browse source 
Installing the runner on sahaquiel, `useradd --system` gave `runner` user ID 999: the ID
under which PostgreSQL and the server run inside their containers, which Docker doesn't
remap. To the kernel, those processes were the runner's own, so a job could have read the
server's environment (database password, session pepper, GitHub secret) and, through
/proc, PostgreSQL's files and its local socket, which the official image trusts. The
sandbox's other walls don't help there: ProtectProc hides only other users' processes,
IPAddressDeny doesn't cover Unix sockets. Only our own check ran as 999; `runner` now has
user and group ID 61000.

The check job now starts with a Sandbox step that fails unless only the runner's own
processes are visible, all in one process namespace, /home/deploy is invisible, the
Docker socket is unusable and Docker's bridge network unreachable. It would have caught
this; outside a sandbox it fails as it should. The unit and AGENTS.md say how to create
the user.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Signed-off-by: Tizian 「ティツィアーン」 <raisondetredev@pm.me>
This commit is contained in:
Tizian 「ティツィアーン」 2026-09-30 22:12:31 +02:00
commit c837cee51f
Signed by: raisondetredev
GPG key ID: 07F6FCF405488B64
1 changed files with 31 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
deploy/runner/forgejo-runner.service
View file

@ -7,6 +7,14 @@
# dependencies' build code. On the production server, so everything below keeps them
# away from production and makes sure CI can't starve the instance. Docker is out of
# reach entirely: `runner` isn't in the docker group, and the socket is hidden too.
#
# `runner` has user and group ID 61000, and must never share a user ID with a
# container's processes (PostgreSQL and the server run as 999; Docker doesn't remap
# them): processes of one user ID can read each other's environment and, through
# /proc, their files. `useradd --system` picks 999 when it is free, so create it with
# useradd --system --uid 61000 --user-group --create-home \
# --home-dir /var/lib/forgejo-runner --shell /usr/sbin/nologin runner
# CI's first step checks this sandbox and fails if it leaks.
[Unit]
Description=Forgejo Actions runner (CI of halkyon_learn; jobs on the host)
Documentation=https://forgejo.org/docs/latest/admin/actions/security/