feat: make the docker socket mount opt-out (github_runner_mount_docker_socket) - #55
Merged
Conversation
… mount opt-out The /var/run/docker.sock bind was unconditional, giving every runner root-equivalent docker access whether or not its jobs use docker. New flag (default true, back-compat) drops the mount for runners whose jobs never touch docker. Motivation: BumpApp/bump#5355 — job containers churn veth interfaces on the runner host, aborting in-flight Chrome requests with ERR_NETWORK_CHANGED; a socket-less runner can't create containers at all. Adds a no-docker-socket molecule scenario asserting the bind is absent, bumps collection to 0.1.6. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
There was a problem hiding this comment.
Pull request overview
This PR introduces an opt-out switch for mounting the host Docker socket into the GitHub Actions runner container, improving least-privilege defaults while keeping backward compatibility.
Changes:
- Add
github_runner_mount_docker_socket(defaulttrue) to gate/var/run/docker.sockingithub_runner_volumes. - Add a
no-docker-socketMolecule scenario and include it in the CI matrix. - Update documentation and release metadata (README, CHANGELOG, galaxy.yml version bump).
Reviewed changes
Copilot reviewed 9 out of 9 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
roles/github_runner/vars/main.yml |
Make the Docker socket bind conditional via github_runner_mount_docker_socket. |
roles/github_runner/defaults/main.yml |
Define the new toggle with documentation and default true. |
README.md |
Document the new variable in the configuration table. |
molecule/no-docker-socket/molecule.yml |
Add a Molecule scenario configuring github_runner_mount_docker_socket: false. |
molecule/no-docker-socket/converge.yml |
Converge playbook to apply the role in the new scenario. |
molecule/no-docker-socket/verify.yml |
Verify the runner container is running and does not mount the Docker socket. |
galaxy.yml |
Bump collection version to 0.1.6. |
CHANGELOG.md |
Add release notes for 0.1.6. |
.github/workflows/lint-and-test.yml |
Add no-docker-socket to the Molecule test matrix. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
default([], true) covers HostConfig.Binds coming back None/undefined (e.g. every volume landing in Mounts): no binds still means no socket. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The
/var/run/docker.sockbind ingithub_runner_volumeswas unconditional — every runner gets root-equivalent docker access even when its jobs never use docker.Concrete motivation: BumpApp/bump#5355. Job containers created through the mounted socket churn veth interfaces on the runner host; Chrome on Linux watches rtnetlink with no interface filter, so each add/remove aborts in-flight requests with
ERR_NETWORK_CHANGED. A runner without the socket can't create containers, guaranteeing its jobs never contribute to the churn — and it's a least-privilege win regardless.What
github_runner_mount_docker_socket(defaulttrue, fully back-compat) gating the socket entry ingithub_runner_volumes.no-docker-socketmolecule scenario (added to the CI matrix) verifying the runner converges and the socket bind is absent.ansible-lint passes locally (production profile, 0 failures/warnings); the volumes expression was evaluated with the flag both ways.
🤖 Generated with Claude Code