myoung34 / docker-github-actions-runner

This will run the new self-hosted github actions runners with docker-in-docker

Docker Github Actions Runner

This will run the new self-hosted github actions runners.

Quick-Start (Examples and Usage)

Please see the wiki Please read the contributing guidelines

Notes

Security

It is known that environment variables are not safe from exfiltration. If you are using this runner make sure that any workflow changes are gated by a verification process (in the actions settings) so that malicious PR's cannot exfiltrate these.

Docker Support

Please note that while this runner installs and allows docker, github actions itself does not support using docker from a self hosted runner yet. For more information:

• actions/runner#406
• actions/runner#367

Also, some GitHub Actions Workflow features, like Job Services, won't be usable and will result in an error.

Containerd Support

Currently runners do not support containerd

Docker Artifacts

Container Base	Supported Architectures	Tag Regex	Docker Tags	Description	Notes
ubuntu focal	x86_64,arm64	/\d\.\d{3}\.\d+/ /\d\.\d{3}\.\d+-ubuntu-focal/	latest ubuntu-focal	This is the latest build (Rebuilt nightly and on master merges). Tags without an OS name are included. Tags with -ubuntu-focal are included and created on upstream tags.
ubuntu jammy	x86_64,arm64	/\d\.\d{3}\.\d+-ubuntu-jammy/	ubuntu-jammy	This is the latest build from jammy (Rebuilt nightly and on master merges). Tags with -ubuntu-jammy are included and created on upstream tags.	There is currently an issue with jammy from inside a 20.04LTS host which is why this is not latest
ubuntu bionic	x86_64,arm64	/\d\.\d{3}\.\d+-ubuntu-bionic/	ubuntu-bionic	This is the latest build from bionic (Rebuilt nightly and on master merges). Tags with -ubuntu-bionic are included and created on upstream tags.
debian buster (now deprecated)	x86_64,arm64	/\d\.\d{3}\.\d+-debian-buster/	debian-buster	Debian buster is now deprecated. The packages for arm v7 are in flux and are wildly causing build failures (git as well as apt-key and liblttng-ust#. Tags with -debian-buster are included and created on upstream tags.
debian bullseye	x86_64,arm64	/\d\.\d{3}\.\d+-debian-bullseye/	debian-bullseye	This is the latest build from bullseye (Rebuilt nightly and on master merges). Tags with -debian-bullseye are included and created on upstream tags.
debian sid	x86_64,arm64	/\d\.\d{3}\.\d+-debian-sid/	debian-sid	This is the latest build from sid (Rebuilt nightly and on master merges). Tags with -debian-sid are included and created on upstream tags.

These containers are built via Github actions that copy the dockerfile, changing the FROM and building to provide simplicity.

Environment Variables

Environment Variable	Description
RUN_AS_ROOT	Boolean to run as root. If true: will run as root. If True and the user is overridden it will error. If any other value it will run as the runner user and allow an optional override. Default is true
RUNNER_NAME	The name of the runner to use. Supersedes (overrides) RUNNER_NAME_PREFIX
RUNNER_NAME_PREFIX	A prefix for runner name (See RANDOM_RUNNER_SUFFIX for how the full name is generated). Note: will be overridden by RUNNER_NAME if provided. Defaults to github-runner
RANDOM_RUNNER_SUFFIX	Boolean to use a randomized runner name suffix (preceded by RUNNER_NAME_PREFIX). Will use a 13 character random string by default. If set to a value other than true it will attempt to use the contents of /etc/hostname or fall back to a random string if the file does not exist or is empty. Note: will be overridden by RUNNER_NAME if provided. Defaults to true.
ACCESS_TOKEN	A github PAT to use to generate RUNNER_TOKEN dynamically at container start. Not using this requires a valid RUNNER_TOKEN
APP_ID	The github application ID. Must be paired with APP_PRIVATE_KEY and should not be used with ACCESS_TOKEN or RUNNER_TOKEN
APP_PRIVATE_KEY	The github application private key. Must be paired with APP_ID and should not be used with ACCESS_TOKEN or RUNNER_TOKEN
APP_LOGIN	The github application login id. Can be paired with APP_ID and APP_PRIVATE_KEY if default value extracted from REPO_URL or ORG_NAME is not correct. Note that no default is present when RUNNER_SCOPE is 'enterprise'.
RUNNER_SCOPE	The scope the runner will be registered on. Valid values are repo, org and ent. For 'org' and 'enterprise', ACCESS_TOKEN is required and REPO_URL is unnecessary. If 'org', requires ORG_NAME; if 'ent', requires ENTERPRISE_NAME. Default is 'repo'.
ORG_NAME	The organization name for the runner to register under. Requires RUNNER_SCOPE to be 'org'. No default value.
ENTERPRISE_NAME	The enterprise name for the runner to register under. Requires RUNNER_SCOPE to be 'enterprise'. No default value.
LABELS	A comma separated string to indicate the labels. Default is 'default'
REPO_URL	If using a non-organization runner this is the full repository url to register under such as 'https://github.com/myoung34/repo'
RUNNER_TOKEN	If not using a PAT for ACCESS_TOKEN this will be the runner token provided by the Add Runner UI (a manual process). Note: This token is short lived and will change frequently. ACCESS_TOKEN is likely preferred.
RUNNER_WORKDIR	The working directory for the runner. Runners on the same host should not share this directory. Default is '/_work'. This must match the source path for the bind-mounted volume at RUNNER_WORKDIR, in order for container actions to access files.
RUNNER_GROUP	Name of the runner group to add this runner to (defaults to the default runner group)
GITHUB_HOST	Optional URL of the Github Enterprise server e.g github.mycompany.com. Defaults to github.com.
DISABLE_AUTOMATIC_DEREGISTRATION	Optional flag to disable signal catching for deregistration. Default is false. Any value other than exactly false is considered true. See here
CONFIGURED_ACTIONS_RUNNER_FILES_DIR	Path to use for runner data. It allows avoiding reregistration each the start of the runner. No default value.
EPHEMERAL	Optional flag to configure runner with --ephemeral option. Ephemeral runners are suitable for autoscaling.
DISABLE_AUTO_UPDATE	Optional environment variable to disable auto updates. Auto updates are enabled by default to preserve past behavior. Any value is considered truthy and will disable them.
START_DOCKER_SERVICE	Optional flag which automatically starts the docker service if set to true. Useful when using sysbox. Defaults to false.
NO_DEFAULT_LABELS	Optional environment variable to disable adding the default self-hosted, platform, and architecture labels to the runner. Any value is considered truthy and will disable them.

docker-github-actions-runner's Issues

Sample of running multiple runners (scale) easily?

Can someone help me out with an example of how to set up multiple runners easily?

I know docker-composer has a parameter scale that can be used to create multiple & identical runners.

My main concern is that the RUNNER_WORKDIR must be unique for each runner, so it needs to take into consideration the scale parameter, or the runner should just create subdirs in the RUNNER_WORKDIR based on the container name?

Or, is there an easier solution?

Thanks in advance

Deprecate eoan and upgrade Ubuntu latest to focal

Network issue with docker on AWS EKS

Hey myoung34,

Thanks for making this image, I run into a network issue while using this image on AWS EKS cluster.

Here is my deployment config, copied from readme.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: actions-runner
  namespace: github
spec:
  replicas: 2
  selector:
    matchLabels:
      app: actions-runner
  template:
    metadata:
      labels:
        app: actions-runner
    spec:
      volumes:
      - name: dockersock
        hostPath:
          path: /var/run/docker.sock
      - name: workdir
        hostPath:
          path: /tmp/github-runner
      containers:
      - name: runner
        image: myoung34/github-runner:latest
        imagePullPolicy: Always
        env:
        - name: ORG_RUNNER
          value: "true"
        - name: ORG_NAME
          value: myorg
        - name: LABELS
          value: test
        - name: RUNNER_TOKEN
          valueFrom:
            secretKeyRef:
              key: RUNNER_TOKEN
              name: actions-runner
        - name: REPO_URL
          value: https://github.com/myorg
        - name: RUNNER_NAME_PREFIX
          value: test
        - name: RUNNER_NAME
          valueFrom:
            fieldRef:
              fieldPath: metadata.name
        - name: RUNNER_WORKDIR
          value: /tmp/github-runner
        - name: RUNNER_GROUP
          value: test
        volumeMounts:
        - name: dockersock
          mountPath: /var/run/docker.sock
        - name: workdir
          mountPath: /tmp/github-runner

While I run docker on the runner, the containers couldn't access the internet. I log into the pod and run a docker image, there isn't any network in that container. I tried the same thing on my laptop, everything was good, not really sure the reason. Setting the -net=host with docker command is a workaround but ugly. I was wondering whether there is a better solution for this?

Hope these screenshots would help you understand.

On my Laptop

On EKS

Zhu Ye

Upgrade to awscli v 2.x

It would be nice to run awscli v2.x like in the ubuntu20 image from gh: actions/runner-images#1816

Error with various actions; Missing GITHUB_EVENT_PATH /github/workflow/event.json

I'm seeing the following error in several actions we pull in regularly - they work fine with GitHub's runners, but not while using this image as a self-hosted runner. I've verified that the /github/workflow folder exists, but whatever process is supposed to be adding the event.json event data doesn't appear to be happening.

GITHUB_EVENT_PATH /github/workflow/event.json does not exist

The resolution that others seem to be reaching with similar issues is to just run the actions-runner directly on the VM, instead of in the container, but I'd love to keep running as a container.

I see this issue specifically with the following actions:

• wagoid/commitlint-github-action
• FranzDiebold/github-env-vars-action

I suspect more would be affected, but those are the ones I know for certain have an issue.

Executable treated like non executable

Hi,

I'm having some issues with running ros industrial_ci using this runner.
Running ros-industrial/industrial_ci fails with exit code 126 when executing first script.

Run ros-industrial/industrial_ci@master
  with:
  env:
    ROS_DISTRO: melodic
    ROS_REPO: main
/tmp/github-runner-your-repo2/_temp/659933a1-9012-4c3b-919b-3955de776141.sh: line 1: /tmp/github-runner-your-repo2/_actions/ros-industrial/industrial_ci/master/.github/action.sh: Permission denied
Error: Process completed with exit code 126.

The script is definitely executable.

Started with.

docker run -d --name github-runner9 \
  -e REPO_URL="https://github.com/Jollerprutt/ci_test" \
  -e RUNNER_NAME_PREFIX="arm-runner" \
  -e ACCESS_TOKEN="<redacted>" \
  -e RUNNER_WORKDIR="/tmp/github-runner-your-repo2" \
  -e RUNNER_GROUP="my-group" \
  -e LABELS="linux,arm64,cluster1,safe" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  --tmpfs /tmp/github-runner-your-repo2 \
  --security-opt=label=disable \
  myoung34/github-runner:latest

Job

industrial_ci_arm64:
    strategy:
      matrix:
        env:
          - {ROS_DISTRO: noetic, ROS_REPO: testing}
          - {ROS_DISTRO: noetic, ROS_REPO: main}
          - {ROS_DISTRO: melodic, ROS_REPO: main}
    runs-on: [self-hosted, linux, ARM64, safe]
    steps:
      - uses: actions/checkout@v1
      - uses: 'ros-industrial/industrial_ci@master'
        env: ${{matrix.env}}

Runs on a RPi4 with ubuntu 18.04.

If I create a container from scratch and install the actions runner with the official script the problem does not occur, so it is most likely related to myoung34/github-runner.
Also the github hosted hosts run it with no issue.

Any idea what could be causing this?
Thanks in advance :)

Restart runner

I wanted to have the container restart after running a workflow to get a fresh container for each workflow. Is that possible?

Thanks

Docker-in-docker-in-docker

I understand this is a little outside scope but is there any chance you could provide an example of (successfully) executing a docker container from within a (your) self-hosted docker runner.

I appreciate your positive response 👍

git is not installed in the Docker image

Even a git-checkout won't work.

Docker in docker actions - workspace files are not found - SOLVED

While running other actions that are inside docker containers I faced issue with files not found, like workfolder is empty.

This is because github container runs other action container (docker-in-docker) with this mount
-v "/_work/_temp/_github_workflow":"/github/workflow"
and since this is handled by docker daemon on host system, path "/_work" does not exists there.

I was able to overcome this issue by specifying same work folder on all containers like in this command:

  docker run -d --restart always --name github-runner \
  -e REPO_URL="https://github.com/***" \
  -e RUNNER_TOKEN="***" \
  -e RUNNER_WORKDIR="/tmp/github-runner" \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /tmp/github-runner:/tmp/github-runner \
  myoung34/github-runner:latest

Add disclaimer in README that it does not support running "Container" and "Services" workflows

due to upstream open issues:

• actions/runner#367
• actions/runner#406

Shouldn't have to provide REPO_URL for Org Runner

When attempting to run an org runner. e.g.

docker run -e ACCESS_TOKEN="foo_token" 
           -e RUNNER_NAME="foo_runner_name" 
           -e ORG_RUNNER="true" 
           -e ORG_NAME="foo_org" ...

...configuration fails with...

Invalid configuration provided for url. Terminating unattended configuration.

Seems that PROTO is not set correctly when REPO_URL is omitted in entrypoint.sh in the ORG_RUNNER=true scenario.

Add note regarding RUNNER_WORKDIR volume mount

I spent the good part of a day trying to understand why github actions were behaving differently when using a local runner, compared to on github's runners. In particular, I was getting "file not found" errors when using actions, but when I did an ls on the files, via a workflow run command, the files were showing up just fine.

I believe what was happening is that because i was running the actions-runner in a docker container with the docker socket mounted from my host system, any docker actions would get a volume mount from the HOST system, rather than the runner's container.

The cause of things not working is that I was binding the RUNNER_WORKDIR to a different folder path on the host system, so the action runner container would see one thing, but the docker actions themselves would see another, because RUNNER_WORKDIR didn't exist on the host system.

It'd likely be good to add a note indicating that RUNNER_WORKDIR must exist on the host system and be the bind-mounted volume for RUNNER_WORKDIR in the container. Hopefully this saves others some time! 👍

Configurable locale.

It would be nice to have configurable or predefined (en_US.UTF-8?) locale. Currently the output for locale command is

root@50a8b097f635:/actions-runner# locale
LANG=
LANGUAGE=
LC_CTYPE="POSIX"
LC_NUMERIC="POSIX"
LC_TIME="POSIX"
LC_COLLATE="POSIX"
LC_MONETARY="POSIX"
LC_MESSAGES="POSIX"
LC_PAPER="POSIX"
LC_NAME="POSIX"
LC_ADDRESS="POSIX"
LC_TELEPHONE="POSIX"
LC_MEASUREMENT="POSIX"
LC_IDENTIFICATION="POSIX"
LC_ALL=

Question: token scope

Hey, thanks for all the awesome work maintaining this project.

We're running this runner in two orgs, but today we started questioning the scopes of the runner.

I've left question marks where I'm confused as to why we need

repo (all) 👍 
admin:org (all) (mandatory for organization-wide runner) ❓ 
admin:public_key - read:public_key ❓ 
admin:repo_hook - read:repo_hook ❓ 
admin:org_hook ❓ 
notifications ❓ 
workflow 👍 

As a result I dropped the permissions down to:

repo (all)
workflow

It still:

• managed to register at the org level
• picked up jobs
• ran the jobs with the correct Docker/AWS permissions.

Is there anything I'm missing when testing reducing the scope here?

SELinux: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock

Putting this here for others.

In the runner:

root@50a4dc272487:/actions-runner# docker ps
Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get http://%2Fvar%2Frun%2Fdocker.sock/v1.40/containers/json: dial unix /var/run/docker.sock: connect: permission denied

On the host:

----
time->Sat Mar  7 21:21:39 2020
type=PROCTITLE msg=audit(1583616099.890:863): proctitle=646F636B6572007073
type=SYSCALL msg=audit(1583616099.890:863): arch=c000003e syscall=42 success=no exit=-13 a0=3 a1=c00056f290 a2=17 a3=0 items=0 ppid=3254 pid=3267 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=pts1 ses=4294967295 comm="docker" exe="/usr/bin/docker" subj=system_u:system_r:container_t:s0:c36,c702 key=(null)
type=AVC msg=audit(1583616099.890:863): avc:  denied  { connectto } for  pid=3267 comm="docker" path="/run/docker.sock" scontext=system_u:system_r:container_t:s0:c36,c702 tcontext=system_u:system_r:container_runtime_t:s0 tclass=unix_stream_socket permissive=0

If you're running the default Docker package from Centos or RH it doesn't disable SELinux at the daemon. Start the container with --security-opt=label=disable.

function github-runner {
    name=github-runner-${1//\//-}
    org=$(dirname $1)
    repo=$(basename $1)
    tag=${3:-latest}
    docker rm -f $name
    docker run -d --restart=always \
        --security-opt=label=disable \
        -e REPO_URL="https://github.com/${org}/${repo}" \
        -e RUNNER_TOKEN="$2" \
        -e RUNNER_NAME="linux-${repo}" \
        -e RUNNER_WORKDIR="/tmp/github-runner" \
        -v /var/run/docker.sock:/var/run/docker.sock \
        -v /tmp/github-runner:/tmp/github-runner \
        --name=$name myoung34/github-runner:${tag}
}

https://bugzilla.redhat.com/show_bug.cgi?id=1669728

Allow the runner to be removed gracefully

When using Kubernetes, it's possible to run a command when the container is stopped. If the runner is not stopped propertly then the runner is not removed from GitHub interface.

Using Kubernetes, can be done by using a lifecycle hook. It would be great if we could suppport that. These are the requirements:

• The shell script to remove the runner should be available in the image.
• RUNNER_TOKEN must be available again, so we can call ./remove.sh and pass the runner token. Looks like it was removed recently.
• The README must be updated containing the instructions to gracefully stop the runner.

Cannot register org runner

I'm trying to deploy org self-hosted runner but something goes wrong, see above logs.
repo specific runner seems to work fine.

Q: Why org runner deployment require REPO_URL environment variable ?

# Authentication


Http response code: NotFound from 'POST https://api.github.com/actions/runner-registration'

{"message":"Not Found","documentation_url":"https://developer.github.com/v3"}

Response status code does not indicate success: 404 (Not Found).

Example docker-compose.yml file

It would be nice to include an example docker-compose.yml file:

version: '2.3'

services:
  worker:
    build: .
    image: myoung34/github-runner:latest
    environment:
      REPO_URL: https://github.com/example/repo
      RUNNER_NAME: example-name
      RUNNER_TOKEN: someGithubTokenHere
      RUNNER_WORKDIR: /home/runner
      ORG_RUNNER: true
      ORG_NAME: example-github-org
      LABELS: linux,x64,gpu
    security_opt:
      - label:disable
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - './data/runner:/home/runner'

Would something like this be ok? If so, should I PR it?

Alpine Variant

Would it be possible to create an alpine variant of this?

What is the recommended way to modify the myoung34/github-runner:latest image?

I'm using docker-compose to run the myoung34/github-runner:latest image. It works great, thanks a lot!

Now I need some extre dependencies. For example, I want to execute:

sudo apt-get install joe

What is the best way to achieve this? I could ofcourse clone this repository, edit the Dockerfile/entrypoint.sh and build my own image, but is there a better (cleaner) way?

docker-compose not available in arm image.

This line, which tries to install docker-compose using the Docker recommended process, fails on ARM:

https://github.com/myoung34/docker-github-actions-runner/blob/master/Dockerfile.base#L57

Instead, we get a file whose contents are Not found.

Docker does not actually release an ARM binary for Docker Compose. It seems to be a long standing problem with a lot of upvotes, and yet still no resolution:

docker/compose#6831

The workaround that I am using on my host (where I have deployed the GitHub Actions runner) is the linuxserver image which does support ARM and is accessed via a run.sh shim:

https://hub.docker.com/r/linuxserver/docker-compose

This is working for me outside of the GitHub Actions runner, with one caveat. Environment variables from the shell are no longer automatically passed through to the compose container. Only special variables like COMPOSE_FILE and COMPOSE_PROJECT_NAME are automatically handled. For everything else, I have to set COMPOSE_OPTIONS='-e FOO -e BAR -e BAZ' to pass these through.

This is still a much better solution than the current completely broken docker-compose binary. I can probably just build my own runner image that has the run.sh shim installed as /usr/local/bin/docker-compose, but it'd be great to see it in the official image.

Container feature is not supported when runner is already running inside container.

I already saw #42

My question is - how is everyone not running into this? It seems like this is a restriction for all OS?
https://github.com/actions/runner/blob/f9b5d626c5486d1f02b3bd45879f61834b7aeecc/src/Runner.Worker/ContainerOperationProvider.cs#L57-L70

The docker runner seems pointless if we can't launch other containers from it. Can someone else describe how they have this working so that I can emulate it?

You can delete this

Auto update error

Configuring

--------------------------------------------------------------------------------
|        ____ _ _   _   _       _          _        _   _                      |
|       / ___(_) |_| | | |_   _| |__      / \   ___| |_(_) ___  _ __  ___      |
|      | |  _| | __| |_| | | | | '_ \    / _ \ / __| __| |/ _ \| '_ \/ __|     |
|      | |_| | | |_|  _  | |_| | |_) |  / ___ \ (__| |_| | (_) | | | \__ \     |
|       \____|_|\__|_| |_|\__,_|_.__/  /_/   \_\___|\__|_|\___/|_| |_|___/     |
|                                                                              |
|                       Self-hosted runner registration                        |
|                                                                              |
--------------------------------------------------------------------------------

# Authentication


√ Connected to GitHub

# Runner Registration



A runner exists with the same name
√ Successfully replaced the runner
√ Runner connection is good

# Runner settings


√ Settings Saved.

.path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/actions-runner
Starting Runner listener with startup type: service
Started listener process
Started running service

√ Connected to GitHub

2021-03-11 03:03:53Z: Listening for Jobs
Runner update in progress, do not shutdown runner.
Downloading 2.277.1 runner
Waiting for current job finish running.
Generate and execute update script.
Runner will exit shortly for update, should back online within 10 seconds.
renamed '/actions-runner/_diag/SelfUpdate-20210311-030517.log' -> '/actions-runner/_diag/SelfUpdate-20210311-030517.log.failed'
Runner listener exited with error code 3
Runner listener exit because of updating, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
events.js:187
      throw er; // Unhandled 'error' event
      ^

Error: spawn /actions-runner/bin/Runner.Listener ENOENT
    at Process.ChildProcess._handle.onexit (internal/child_process.js:264:19)
    at onErrorNT (internal/child_process.js:456:16)
    at processTicksAndRejections (internal/process/task_queues.js:80:21)
Emitted 'error' event on ChildProcess instance at:
    at Process.ChildProcess._handle.onexit (internal/child_process.js:270:12)
    at onErrorNT (internal/child_process.js:456:16)
    at processTicksAndRejections (internal/process/task_queues.js:80:21) {
  errno: 'ENOENT',
  code: 'ENOENT',
  syscall: 'spawn /actions-runner/bin/Runner.Listener',
  path: '/actions-runner/bin/Runner.Listener',
  spawnargs: [ 'run', '--startuptype', 'service' ]
}

What's the problem?

Support register runner to organization level

since actions runner 2.168.0, it supports registering at organization level, and this feature is available on githut.com now.

need to update the runner registration script to support organization, something like:
https://github.com/actions/runner/blob/master/scripts/create-latest-svc.sh#L69-L75

Try to use Docker inside the Build

Support to register runner at enterprise account level

Please support the new feature of having runners at enterprise account level:
https://github.blog/changelog/2020-08-05-github-actions-enterprise-runners-and-runner-groups

Can you get the latest version number of runner through the GitHub API?

So we can use the latest version every time we run it.

Just like this:

RUN GITHUB_RUNNER_VERSION=$(curl --silent "https://api.github.com/repos/actions/runner/releases/latest" | jq -r '.tag_name[1:]') \
    && curl -Ls https://github.com/actions/runner/releases/download/v${GITHUB_RUNNER_VERSION}/actions-runner-linux-x64-${GITHUB_RUNNER_VERSION}.tar.gz | tar xz \
    && sudo ./bin/installdependencies.sh

https://github.com/SanderKnape/github-runner/blob/master/Dockerfile

action/checkout fails on self-hosted gh runner: 'Error: fatal: missing blob object'

Hi, I'm experiencing following error on self-hosted Github runner while checking out the repository.

  Error: fatal: missing blob object '7d837edebba537b71b0d76a31242b48e56a3580f'
  Error: error: remote did not send all necessary objects
  Error: The process '/usr/bin/git' failed with exit code 1

All other jobs on public runners in my configuration are working; it starts to fail, once it starts to trigger jobs on self hosted runners.

Tried following things to solve this problem:

• deleting pod on kubernetes which contains gh-runner
• changing action/checkout version from 2 to 2.3.4

System information

• GH runner image: myoung34/github-runner:latest
• Git version on GH runner: 2.29.0

Steps to reproduce

• Triggering all jobs on the private repository either manually or automatically

---

Any advice on how to make this work? Thanks in advance.

focal image

Github standard runners default to focal (20.04) - maybe this image should provide that flavour too?

Is using the Personal Access Token the only way to get the runner token to register the self-hosted runner at the organization level?

Can we use the github app or oauth app instead of github PAT to generate the RUNNER_TOKEN? The problem with PAT is that none of our Github organization admins want to give the PAT.

ACCESS_TOKEN | A github PAT to use to generate RUNNER_TOKEN dynamically at container start. Not using this requires a valid RUNNER_TOKEN

Runner for organization: 403 Forbidden

I've used myoung34/docker-github-actions-runner dockerized self-hosted runner for 6 months and everything was fine.
Now, I'm trying to enable my GitHub self-hosted runner for my organization, but, no luck.
It keeps reporting 403 error:

curl: (22) The requested URL returned error: 403 Forbidden
Configuring

...SKIP...

# Authentication

Invalid configuration provided for token. Terminating unattended configuration.
.path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/actions-runner
Starting Runner listener with startup type: service
Started listener process
Started running service
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured

... and so on.

I found my organization name here:

I've created a token with appropriate permissions (according to official GitHub documentation):

And this is a command I use to start:

docker run -e RUNNER_NAME_PREFIX="myrnr" \
-e ACCESS_TOKEN="116f109961bfd1a9a689a4fe1db25a0834a17e0f" \
-e ORG_RUNNER="true" \
-e ORG_NAME="MyOrgNameFrom1stScreenshot" \
-e RUNNER_WORKDIR="/tmp/github-runner" \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /tmp/github-runner:/tmp/github-runner \
 myoung34/github-runner:latest

So... what I am doing wrong?

Random RUNNER_NAME

Thanks so much for your awesome docker image. It's almost perfect for me!

I'm setting up an ECS service to run your docker image. Github requires that each RUNNER_NAME be unique. There's really no way for an ECS service to assign unique values to each task run. If you could add an easy to add a random string suffix to the runner name, that would be amazing. I can provide a patch if you like. Something simple like $RUNNER_NAME-$RANDOM would be great.

How to utilize this for hosting as Github Actions runner under Github Enterprise

Hi ,

I am looking for a help in hosting this Github Actions Runner in our Github Enterprise, need help in knowing the process .

Regards ,
Praveen .

Runner will exit shortly for update, should back online within 10 seconds. loop

Hi there, I just setup a new runner, only the runner has an update, when I tail the logs I see:

Runner update in progress, do not shutdown runner. Downloading 2.168.0 runner Waiting for current job finish running. Generate and execute update script. Runner will exit shortly for update, should back online within 10 seconds.

Image as Non-Root

It is possible to run this image without root?

As a workaround I changed the access control of the folders I have to access by extending your image.

awscli?

Can I request that awscli be installed inside the container? It would be huge convienence.

Fails to deregister

I am trying to use this docker image with Kubernetes deployment. It registers well with the Github but when the container terminates, it just leaves the runner registered to the GitHub. I don't see any errors when it terminate. Have anyone seen similar issues?

│ # Authentication                                                                                                                                                               │
│ √ Connected to GitHub                                                                                                                                                          │
│ # Runner Registration                                                                                                                                                          │
│ √ Runner successfully added                                                                                                                                                    │
│ √ Runner connection is good                                                                                                                                                    │
│ # Runner settings                                                                                                                                                              │
│ √ Settings Saved.                                                                                                                                                              │
│ .path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/actions-runner                                                                                             │
│ Starting Runner listener with startup type: service                                                                                                                            │
│ Started listener process                                                                                                                                                       │
│ Started running service                                                                                                                                                        │
│ √ Connected to GitHub                                                                                                                                                          │
│ 2020-06-19 23:01:22Z: Listening for Jobs                                                                                                                                       │
│ stream closed

I am facing resource temporarily unavailable

Hi ,

Need help inn setting up enterprise

I ran as below for Github ENterprise and able to login to a container

docker run -d --restart always --name github-runner -e RUNNER_NAME_PREFIX="myrunner" -e ACCESS_TOKEN="*PAT" -e RUNNER_WORKDIR="/tmp/gh-actions" -e RUNNER_GROUP="my-group" -e ORG_RUNNER="true" -e ORG_NAME="org-name" -e LABELS="myoung,other-label" -e GITHUB_HOST="https://something.com" -v /var/run/docker.sock:/var/run/docker.sock -v /tmp/gh-actions/:/tmp/gh-actions/ myoung34/github-runner:latest

By running as above able to login to a container , when i am trying to execute the config.sh . I see below requested parameters

---

| ____ _ _ _ _ _ _ _ _ |
| / () || | | | | |_ / \ | |() ___ _ __ ___ |
| | | | | __| || | | | | ' \ / _ \ / | | |/ _ | ' / | |
| | || | | || _ | || | |) | / ___ \ (| || | () | | | __ \ |
| _||_|| ||_,|.__/ // __|_||_/|| ||___/ |
| |
| Self-hosted runner registration |
| |

Authentication

What is the URL of your repository? https://github.com/myoung34/docker-github-actions-runner. -- what is the repo url here should be ?
What is your runner register token? ****************************************

I am seeing below error on providing thhe above requested params
Resource temporarily unavailable

Docker health check

Is there any way for the container to detect if it self is healthy?

I'm running my action runner in k8s pods, and it works fine for the most part, but sometimes the process seems to crash, and when that happens the auth logic doesn't seem to work and the pod ends up in an endless loop with this error:

Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.
Starting Runner listener with startup type: service
Started listener process
An error occurred: Not configured
Runner listener exited with error code 2
Runner listener exit with retryable error, re-launch runner in 5 seconds.

I was trying to find if there was anything I could use to create a healthcheck, but the only thing I could find was logs... and parsing logs as part of a healthcheck is a last resort for me.

Do you guys have any ideas?

Wrong binaries for ARM architecture in docker image

On my Raspberry PI 4

pentusha@pc0:~ $ arch; docker run -it myoung34/github-runner:latest /actions-runner/bin/Runner.Listener
armv7l
ldd: ./bin/libcoreclr.so: No such file or directory
ldd: ./bin/System.Security.Cryptography.Native.OpenSsl.so: No such file or directory
ldd: ./bin/System.IO.Compression.Native.so: No such file or directory
/actions-runner/config.sh: line 78: ./bin/Runner.Listener: cannot execute binary file: Exec format error
/actions-runner/run.sh: line 27: /actions-runner/bin/Runner.Listener: cannot execute binary file: Exec format error

On my x86-64 pc works well

arch; docker run -it myoung34/github-runner:latest /actions-runner/bin/Runner.Listener
x86_64
ldd: ./bin/libcoreclr.so: No such file or directory
ldd: ./bin/System.Security.Cryptography.Native.OpenSsl.so: No such file or directory
ldd: ./bin/System.IO.Compression.Native.so: No such file or directory

--------------------------------------------------------------------------------
|        ____ _ _   _   _       _          _        _   _                      |
|       / ___(_) |_| | | |_   _| |__      / \   ___| |_(_) ___  _ __  ___      |
|      | |  _| | __| |_| | | | | '_ \    / _ \ / __| __| |/ _ \| '_ \/ __|     |
|      | |_| | | |_|  _  | |_| | |_) |  / ___ \ (__| |_| | (_) | | | \__ \     |
|       \____|_|\__|_| |_|\__,_|_.__/  /_/   \_\___|\__|_|\___/|_| |_|___/     |
|                                                                              |
|                       Self-hosted runner registration                        |
|                                                                              |
--------------------------------------------------------------------------------

# Authentication

What is the URL of your repository? Exiting...
An error occurred: Not configured

Pretty sure that ACTIONS_ARCH not respected and it is always x64.

Size of overlay2 folder

Hello,

i have an issue with the overlay2 folder. There is a folder that contains the data of the image from your Dockerfile but it causes on my server 17 GB of disk usage. Can you explain me that? I`m not an expert in docker so i dont know how to reduce it. Can i simple delete this folder? I mean the image itself is only 2.1 GB in Size why does it use so much more on the disk?

Thank you for the great work and the really good possibility to run an action runner inside docker.

Kind Regards

Switch to Ubuntu 20.04 or 18.04

Can we please switch the base image to use either Ubuntu 18.04 or 20.04. As actions/setup-python only supports those two versions.

https://raw.githubusercontent.com/actions/python-versions/master/versions-manifest.json

Repo-Runner: Invalid configuration provided for token (PAT)

Hey,

first of all: thank you so much for your work!

I'm trying to self-host a repo runner. Works with the RUNNER_TOKEN but whatever PAT I provide I get the following error:

worker_1  | # Authentication
worker_1  | 
worker_1  | Invalid configuration provided for token. Terminating unattended configuration.
worker_1  | .path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/actions-runner
worker_1  | Starting Runner listener with startup type: service
worker_1  | Started listener process
worker_1  | Started running service
worker_1  | An error occurred: Not configured
worker_1  | Runner listener exited with error code 2
worker_1  | Runner listener exit with retryable error, re-launch runner in 5 seconds.

docker-compose.yml with RUNNER_TOKEN:

version: '3.7'

services:
  worker:
    image: myoung34/github-runner:latest
    environment:
      REPO_URL: https://my.enterprise.github/reponame
      RUNNER_NAME: example-name
      RUNNER_TOKEN: AAABSK3BWNOIMZ7BBJM55WDABxxxx
      RUNNER_WORKDIR: /tmp/runner/work
      RUNNER_GROUP: my-group
      ORG_RUNNER: 'false'
      LABELS: linux,x64,gpu
    security_opt:
      # needed on SELinux systems to allow docker container to manage other docker containers
      - label:disable
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - '/tmp/runner:/tmp/runner'
      # note: a quirk of docker-in-docker is that this path
      # needs to be the same path on host and inside the container,
      # docker mgmt cmds run outside of docker but expect the paths from within

docker-compose.yml for PAT:

version: '3.7'

services:
  worker:
    image: myoung34/github-runner:latest
    environment:
      REPO_URL: https://my.enterprise.github/reponame
      RUNNER_NAME: example-name-pat
      ACCESS_TOKEN: e9f1378648e4f677aa2c5b0a5130f6fce523xxxx
      RUNNER_WORKDIR: /tmp/runner/work
      RUNNER_GROUP: my-group
      ORG_RUNNER: 'false'
      LABELS: linux,x64,gpu
    security_opt:
      # needed on SELinux systems to allow docker container to manage other docker containers
      - label:disable
    volumes:
      - '/var/run/docker.sock:/var/run/docker.sock'
      - '/tmp/runner:/tmp/runner'
      # note: a quirk of docker-in-docker is that this path
      # needs to be the same path on host and inside the container,
      # docker mgmt cmds run outside of docker but expect the paths from within

I provided all OAuth scopes for the PAT:

While I'm writing this - I might have found the issue. Our API endpoint is:
https://my.enterprise.github/api/v3 - as far as I have understood your token.sh script always uses api.github.com, right?

Could that be the issue? Is there any way to configure the API endpoint (optional parameter)? :)

Cheers and thanks in advance,
Max

ACCESS_TOKEN is available to build jobs

Inside of a build job, the ACCESS_TOKEN env variable is still set. This should not be usable by builds. Please unset that variable in entrypoint.sh after it is used. Thanks!

conditional unregistration?

Hi - I have a similar image in https://github.com/evryfs/github-actions-runner, but think I could maybe drop it in favour of this one.
I manage the pods with https://github.com/evryfs/github-actions-runner-operator
The operator handles unregistration, and hence I'd like to avoid the runner pod to attempt to do this itself in https://github.com/myoung34/docker-github-actions-runner/blob/master/entrypoint.sh#L43

Would you accept to make that step conditional by passing some var?

Size of image?

First of all, thank you for the image! Makes it wonderfully simple to get started.

May I ask if you'd like to optimise the image size, as it currently weights in at 1.27GB? A "pull-requests welcomed" answer is fine, just looking to orient myself before I try to dive in in case the size is actually a considered or solved topic already.

No License

Looking to see if this repository intentionally has no license.

Thanks in advance!

Can't use container syntax

Do you know if it's possible to get around this error currently

"Container feature is not supported when runner is already running inside container."

Thanks