Run as a container (#8) including Docker-in-Docker. #84

This adds a very simple Dockerfile and run script for running act_runner as a container.

It also allows setting Privileged and ContainerOptions flags via the new config file when spawning task containers. The combination makes it possible to use Docker-in-Docker (if installed in the select task executor image), which requires privileged mode, as well as pass any other options child Docker containers may require.

For example, if Gitea is running in Docker on the same machine, for the checkout action to behave as expected from a task container launched by act_runner, it might be necessary to map the hostname via something like:

container:
  network_mode: bridge
  privileged: true
  options: --add-host=my.gitea.hostname:host-gateway

NOTE: Description updated to reflect latest code.
NOTE: Description updated to reflect latest code (again).

This adds a very simple Dockerfile and run script for running `act_runner` as a container. It also allows setting `Privileged` and `ContainerOptions` flags via the new config file when spawning task containers. The combination makes it possible to use Docker-in-Docker (if installed in the select task executor image), which requires `privileged` mode, as well as pass any other options child Docker containers may require. For example, if Gitea is running in Docker on the same machine, for the `checkout` action to behave as expected from a task container launched by `act_runner`, it might be necessary to map the hostname via something like: ``` container: network_mode: bridge privileged: true options: --add-host=my.gitea.hostname:host-gateway ``` > NOTE: Description updated to reflect latest code. > NOTE: Description updated to reflect latest code (again).

In response to comments, I updated the the code to add the following configuration options:

dockerContainerOptions / GITEA_RUNNER_DOCKER_CONTAINER_OPTIONS
dockerNetworkMode / GITEA_RUNNER_DOCKER_NETWORK_MODE default:"bridge"
dockerPrivileged / GITEA_RUNNER_DOCKER_PRIVILEGED default:"false"

That way privileged mode can remain disabled by default, for those not needing dind support, and additional container options can be specified more easily (eg, --add-host=my.gitea.host:host-gateway).

NOTE: Outdated by config file.

In response to comments, I updated the the code to add the following configuration options: ``` dockerContainerOptions / GITEA_RUNNER_DOCKER_CONTAINER_OPTIONS dockerNetworkMode / GITEA_RUNNER_DOCKER_NETWORK_MODE default:"bridge" dockerPrivileged / GITEA_RUNNER_DOCKER_PRIVILEGED default:"false" ``` That way `privileged` mode can remain disabled by default, for those not needing dind support, and additional container options can be specified more easily (eg, `--add-host=my.gitea.host:host-gateway`). > NOTE: Outdated by config file.

I also switched to alpine for the act_runner base image, to slim it down. The final size dropped from 159MB to 38MB.

I also switched to alpine for the `act_runner` base image, to slim it down. The final size dropped from 159MB to 38MB.

Incidentally, I'm open to leaving Dockerfile.task-executor out of this PR, as that exact image is not required, it is simply a working example.

Incidentally, I'm open to leaving `Dockerfile.task-executor` out of this PR, as that exact image is not required, it is simply a working example.

Incidentally, I'm open to leaving Dockerfile.task-executor out of this PR, as that exact image is not required, it is simply a working example.

Yes, at least not this PR.

> Incidentally, I'm open to leaving `Dockerfile.task-executor` out of this PR, as that exact image is not required, it is simply a working example. Yes, at least not this PR.

Incidentally, I'm open to leaving Dockerfile.task-executor out of this PR, as that exact image is not required, it is simply a working example.

Yes, at least not this PR.

Done.

> > Incidentally, I'm open to leaving `Dockerfile.task-executor` out of this PR, as that exact image is not required, it is simply a working example. > > Yes, at least not this PR. Done.

For some reason my replies to the comment about ACTIONS_CACHE_URL are not being saved. The short answer is that was a good catch, as it was an inadvertent change, the result of a merge error when I rebased.

It is fixed now.

For some reason my replies to the comment about `ACTIONS_CACHE_URL` are not being saved. The short answer is that was a good catch, as it was an inadvertent change, the result of a merge error when I rebased. It is fixed now.

Are there any other changes or improvements you would like me to make to this PR?

Please resolve the conflicts. I will have a test again after that.

Sorry for causing conflicts in this PR. They mainly come from Refactor environment variables to configuration and registration, but it has been in my mind for a long time, see #21.

Sorry for causing conflicts in this PR. They mainly come from [Refactor environment variables to configuration and registration](https://gitea.com/gitea/act_runner/pulls/90), but it has been in my mind for a long time, see #21.

It was more like a port than a merge, but it seems to be working for me. The new code also simplified things a good deal.

LGTM

Great, thanks!

Are there plans to publish this to a public registry, so it can be used in docker-compose setups?

I found there are some problems, I think we can release it to dockerhub or other places once it fixed.

Let me know if there is anything I need to do/fix.

Let me know if there is anything I need to do/fix.

The running container cannot be shutdown with ctrl + C

> Let me know if there is anything I need to do/fix. The running container cannot be shutdown with ctrl + C

Let me know if there is anything I need to do/fix.

The running container cannot be shutdown with ctrl + C

I'm not able to reproduce this, at least not at first glance:

❯ docker run -it cerc/act-runner:local
level=info msg="Registering runner, arch=amd64, os=linux, version=0.1.1."
level=error msg="Invalid input, please re-run act command." error="instance address is empty"
Waiting to retry ...
^C
❯ echo $?
130

One thing that might be worth trying is to explicitly trap Ctrl-C:

diff --git a/run.sh b/run.sh
index aa8f456..b2f8208 100755
--- a/run.sh
+++ b/run.sh
@@ -1,5 +1,12 @@
 #!/usr/bin/env bash

+trap ctrl_c INT
+
+function ctrl_c() {
+  echo "aborted" 1>&2
+  exit 129
+}
+
 if [[ ! -d /data ]]; then
   mkdir -p /data
 fi

After which I get:

❯ docker run -it cerc/act-runner:local
level=info msg="Registering runner, arch=amd64, os=linux, version=0.1.1."
level=error msg="Invalid input, please re-run act command." error="instance address is empty"
Waiting to retry ...
^Caborted
❯ echo $?
129

> > Let me know if there is anything I need to do/fix. > > The running container cannot be shutdown with ctrl + C I'm not able to reproduce this, at least not at first glance: ``` ❯ docker run -it cerc/act-runner:local level=info msg="Registering runner, arch=amd64, os=linux, version=0.1.1." level=error msg="Invalid input, please re-run act command." error="instance address is empty" Waiting to retry ... ^C ❯ echo $? 130 ``` One thing that might be worth trying is to explicitly trap Ctrl-C: ``` diff --git a/run.sh b/run.sh index aa8f456..b2f8208 100755 --- a/run.sh +++ b/run.sh @@ -1,5 +1,12 @@ #!/usr/bin/env bash +trap ctrl_c INT + +function ctrl_c() { + echo "aborted" 1>&2 + exit 129 +} + if [[ ! -d /data ]]; then mkdir -p /data fi ``` After which I get: ``` ❯ docker run -it cerc/act-runner:local level=info msg="Registering runner, arch=amd64, os=linux, version=0.1.1." level=error msg="Invalid input, please re-run act command." error="instance address is empty" Waiting to retry ... ^Caborted ❯ echo $? 129 ```

Using podman with the docker compat layer, I can reproduce the described behavior when using docker run local/act_runner without the -it flag.

Trapping INT in run.sh did fix the problem for me.

Using podman with the docker compat layer, I can reproduce the described behavior when using `docker run local/act_runner` without the `-it` flag. Trapping `INT` in `run.sh` did fix the problem for me.

 @ -79,6 +79,7 @@ func NewTask(forgeInstance string, buildID int64, client client.Client, runnerEn
 		Input: &TaskInput{
 			envs:                 runnerEnvs,
 			containerNetworkMode: "bridge", // TODO should be configurable
 			privileged:           true,     // TODO should be configurable

 @ -33,3 +36,2 @@
 	}
 	if s.CacheHandler != nil {
 		env["ACTIONS_CACHE_URL"] = s.CacheHandler.ExternalURL() + "/"
 	env["ACTIONS_CACHE_URL"] = s.CacheHandler.ExternalURL() + "/"

 @ -0,0 +5,4 @@
 RUN make build
 FROM ubuntu:22.04 as runner

Run as a container (#8) including Docker-in-Docker. #84

Reviewers