feat: work with rootless docker (#175)

Running docker currently mounts the docker.sock file into the container.
This was introduced in d6c937fe37 but
there is no explanation provided.

The docker.sock file is only needed if we want to run docker inside the container
to create other images or start other containers.
I searched through the code and I did not find any such use.

In particular, on fedora this gives permission denied because docker.sock
is owned by root and the container runs under an unprivileged user.
One has to change the permissions of docker.sock
(which is actually a link to /run/podman/podman.sock) to be writeable by the user.

If we don't need to use docker inside the containers,  then we can remove this file,
thus we can run this GitHub action as an unprivileged user out of the box.
pull/176/head
Paul Pacheco 2022-03-26 20:03:16 -05:00 committed by GitHub
parent 29ad0eb103
commit f87ed30c30
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
3 changed files with 1 additions and 3 deletions

1
dist/index.js generated vendored
View File

@ -209,7 +209,6 @@ const Docker = {
--env RUNNER_WORKSPACE \
--env GIT_PRIVATE_TOKEN="${gitPrivateToken}" \
${sshAgent ? '--env SSH_AUTH_SOCK=/ssh-agent' : ''} \
--volume "/var/run/docker.sock":"/var/run/docker.sock" \
--volume "${githubHome}":"/root:z" \
--volume "${githubWorkflow}":"/github/workflow:z" \
--volume "${workspace}":"/github/workspace:z" \

2
dist/index.js.map generated vendored

File diff suppressed because one or more lines are too long

View File

@ -69,7 +69,6 @@ const Docker = {
--env RUNNER_WORKSPACE \
--env GIT_PRIVATE_TOKEN="${gitPrivateToken}" \
${sshAgent ? '--env SSH_AUTH_SOCK=/ssh-agent' : ''} \
--volume "/var/run/docker.sock":"/var/run/docker.sock" \
--volume "${githubHome}":"/root:z" \
--volume "${githubWorkflow}":"/github/workflow:z" \
--volume "${workspace}":"/github/workspace:z" \