Docker Github Actions Runner
This will run the new self-hosted github actions runners.
Quick-Start (Examples and Usage)
Please see the wiki
Notes
Security
It is known that currently tokens (ACCESS_TOKEN / RUNNER_TOKEN ) are not safe from exfiltration. If you are using this runner make sure that any workflow changes are gated by a verification process (in the actions settings) so that malicious PR's cannot exfiltrate these.
Docker Support
Please note that while this runner installs and allows docker, github actions itself does not support using docker from a self hosted runner yet. For more information:
Also, some GitHub Actions Workflow features, like Job Services, won't be usable and will result in an error.
Containerd Support
Currently runners do not support containerd
Docker-Compose on ARM
Please note docker-compose does not currently work on ARM (see issue) so it is not installed on ARM based builds here.
A workaround exists, please see here
Docker Artifacts
| Container Base | Supported Architectures | Tag Regex | Docker Tags | Description | Notes |
|---|---|---|---|---|---|
| ubuntu focal | x86_64,arm64 |
/\d\.\d{3}\.\d+/ /\d\.\d{3}\.\d+-ubuntu-focal/ |
latest ubuntu-focal | This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with -ubuntu-focal are included and created on upstream tags. |
|
| ubuntu jammy | x86_64,arm64 |
/\d\.\d{3}\.\d+-ubuntu-jammy/ |
ubuntu-jammy | This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with -ubuntu-jammy are included and created on upstream tags. |
There is currently an issue with jammy from inside a 20.04LTS host which is why this is not latest |
| ubuntu bionic | x86_64,arm64 |
/\d\.\d{3}\.\d+-ubuntu-bionic/ |
ubuntu-bionic | This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with -ubuntu-bionic are included and created on upstream tags. |
|
| debian buster (now deprecated) | x86_64,arm64 |
/\d\.\d{3}\.\d+-debian-buster/ |
debian-buster | Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with -debian-buster are included and created on upstream tags. |
|
| debian bullseye | x86_64,arm64 |
/\d\.\d{3}\.\d+-debian-bullseye/ |
debian-bullseye | This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with -debian-bullseye are included and created on upstream tags. |
|
| debian sid | x86_64,arm64 |
/\d\.\d{3}\.\d+-debian-sid/ |
debian-sid | This is the latest build from sid (Rebuilt nightly and on master merges). Tags with -debian-sid are included and created on upstream tags. |
These containers are built via Github actions that copy the dockerfile, changing the FROM and building to provide simplicity.
Environment Variables
| Environment Variable | Description |
|---|---|
RUNNER_NAME |
The name of the runner to use. Supercedes (overrides) RUNNER_NAME_PREFIX |
RUNNER_NAME_PREFIX |
A prefix for a randomly generated name (followed by a random 13 digit string). You must not also provide RUNNER_NAME. Defaults to github-runner |
ACCESS_TOKEN |
A github PAT to use to generate RUNNER_TOKEN dynamically at container start. Not using this requires a valid RUNNER_TOKEN |
RUNNER_SCOPE |
The scope the runner will be registered on. Valid values are repo, org and ent. For 'org' and 'enterprise', ACCESS_TOKEN is required and REPO_URL is unneccesary. If 'org', requires ORG_NAME; if 'enterprise', requires ENTERPRISE_NAME. Default is 'repo'. |
ORG_NAME |
The organization name for the runner to register under. Requires RUNNER_SCOPE to be 'org'. No default value. |
ENTERPRISE_NAME |
The enterprise name for the runner to register under. Requires RUNNER_SCOPE to be 'enterprise'. No default value. |
LABELS |
A comma separated string to indicate the labels. Default is 'default' |
REPO_URL |
If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo' |
RUNNER_TOKEN |
If not using a PAT for ACCESS_TOKEN this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. ACCESS_TOKEN is likely preferred. |
RUNNER_WORKDIR |
The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files. |
RUNNER_GROUP |
Name of the runner group to add this runner to (defaults to the default runner group) |
GITHUB_HOST |
Optional URL of the Github Enterprise server e.g github.mycompany.com. Defaults to github.com. |
DISABLE_AUTOMATIC_DEREGISTRATION |
Optional flag to disable signal catching for deregistration. Default is false. Any value other than exactly false is considered true. See here |
CONFIGURED_ACTIONS_RUNNER_FILES_DIR |
Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value. |
EPHEMERAL |
Optional flag to configure runner with --ephemeral option. Ephemeral runners are suitable for autoscaling. |
DISABLE_AUTO_UPDATE |
Optional environment variable to disable auto updates. Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them. |