scribemd / rootless-docker

Run Docker in Rootless Mode to Prevent Permission Errors

rootless-docker

Run Docker in Rootless Mode to Prevent Permission Errors

• rootless-docker
  • Usage
  • Supported Runners
  • Permissions
  • Changelog

GitHub-hosted (and many self-hosted) runners use rootful Docker, but the runner itself does not run as root. As described in actions/runner#434, files created by Docker containers are hence owned by root, resulting in permission errors when the runner attempts to clean up checked out repositories. This action efficiently prevents those permission errors by running Docker in rootless mode so that all files are owned by the runner user. This approach has many benefits as it is:

• safer than elevating the runner to root
• less brittle than changing the ownership/permissions of or deleting files
• simpler than other ways of running rootless Docker
• and fast (~15 seconds on GitHub-hosted runner ubuntu-22.04)

Docker's documentation discusses rootless mode in detail. If you are running a supported Linux distribution locally, you can follow the steps there to use rootless mode. If you aren't sure, you can ask Docker whether it is in rootless mode:

docker info --format "{{ .ClientInfo.Context }}"

Usage

• Add the following step before your first use of Docker:

  - name: Use Docker in rootless mode.
    uses: ScribeMD/[email protected]

Supported Runners

• Tested on ubuntu-22.04
• Probably works on ubuntu-18.04 and ubuntu-20.04
• May work on future versions of Linux
• Definitely doesn't work on Windows or macOS since Docker only offers rootless mode on Linux

Permissions

No permissions are required.

Changelog

Please refer to CHANGELOG.md.

rootless-docker's Issues

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Pending Approval

These branches will be created by Renovate only once you click their checkbox below.

• chore(deps): bump actions/checkout action to v4.1.5
• chore(deps): bump poetry from v1.8.2 to v1.8.3
• chore(deps): bump pre-commit hook princetonuniversity/blocklint to v0.2.5
• chore(deps): bump scribemd/pre-commit-action action to v0.9.129
• chore(deps): bump scribemd/slack-templates action to v0.6.38
• chore(engines): bump python from v3.12.2 to v3.12.3
• chore(deps): bump commitizen to v3.25.0 (commitizen, commitizen-tools/commitizen)
• chore(deps): bump node from v20.11.1 to v20.13.0
• chore(deps): bump pre-commit from v3.6.2 to v3.7.0
• chore(deps): bump pre-commit hook pre-commit/pre-commit-hooks to v4.6.0
• chore(deps-dev): bump megalinter docker tag to v7.11.1
• chore(deps): bump pre-commit hook frnmst/md-toc to v9.0.0
• 🔐 Create all pending approval PRs at once 🔐

Awaiting Schedule

These updates are awaiting their schedule. Click on a checkbox to get an update now.

• chore(deps): lock file maintenance

Detected dependencies

asdf

.tool-versions

• node 20.11.1
• python 3.12.2
• poetry 1.8.2

github-actions

.github/workflows/notify-assignee.yaml

• ScribeMD/slack-templates 0.6.37@bea126c3915616204196f29d27d6ab9526d61a25

.github/workflows/notify-reviewers.yaml

• ScribeMD/slack-templates 0.6.37@bea126c3915616204196f29d27d6ab9526d61a25

.github/workflows/test.yaml

• actions/checkout v4.1.1@b4ffde65f46336ab88eb53be808477a3936bae11
• ScribeMD/pre-commit-action 0.9.127@832e026101148e0234fde20eecf91c08942ace4a
• ScribeMD/slack-templates 0.6.37@bea126c3915616204196f29d27d6ab9526d61a25
• ubuntu 22.04

pep621

pyproject.toml

• poetry-core ==1.9.0

poetry

pyproject.toml

• python ==3.12.2
• commitizen ==3.18.4
• pre-commit ==3.6.2

pre-commit

.pre-commit-config.yaml

• ScribeMD/pre-commit-hooks 0.16.3
• frnmst/md-toc 8.2.3
• pre-commit/pre-commit-hooks v4.5.0
• PrincetonUniversity/blocklint v0.2.4
• commitizen-tools/commitizen v3.18.4
• jumanjihouse/pre-commit-hooks 3.0.0

regex

.github/renovate.json

• ScribeMD/.github 0.14.16

.pre-commit-config.yaml

• python 3.12.2

.pre-commit-config.yaml

• MegaLinter v7.7.0

.mega-linter.yaml

• ScribeMD/.github 0.14.16

---

• Check this box to trigger a request for Renovate to run again on this repository

Is the example in the README correct?

I have tried the example in the README in a workflow.

- name: Use Docker in rootless mode.
  uses: ScribeMD/rootless-docker@0

I observe the following error:

Error: Unable to resolve action ScribeMD/rootless-docker@0, unable to find version 0