FreeBSD jailing (setup hooks?)

[hasufell]

Runner works great on FreeBSD. I was wondering if anyone has a setup where the action is automatically executed in a new clean jail. Basically some sort of setup and tear-down hooks, but transparent (no changes to the workflow).

[hasufell]

I found https://docs.github.com/en/actions/hosting-your-own-runners/managing-self-hosted-runners/running-scripts-before-or-after-a-job but am not sure yet how that allows me to change the working dir/env of the job

[hasufell]

https://github.com/orgs/community/discussions/45823

Looks like there's no solution.

[ChristopherHX]

This isn't actions/runner, so that specfic pre post hook doesn't exist. While other possibilities exist.

[ChristopherHX]

In the early days this has been created around this project
https://github.com/davidchisnall/act-pot

Doesn't look maintained

[ChristopherHX]

This runner can spawn the worker that executing code in a new process via --worker-args (comma seperated list of args)

A non isolated new process worker would be
--worker-args github-act-runner,worker

If your jail allows communicating with GitHub + your worker script forwards stdin, you could write a shellscript which mounts github-act-runner into a new jail / has it's own copy of the binary and execute the worker inside the jail (github-act-runner worker).

Otherwise use --ephemeral during configure to harden the runner credentials and start the whole runner in a jail using a new runner configuration everytime a new job is started. The jail would exit after one job has run.

[hasufell]

I don't really understand what --worker-args github-act-runner,worker means. I also don't see any documentation in this repository about it.

The jail can provide a github-act-runner binary just fine, that's not the problem. How exactly do I use --worker-args to start a new jail and execute the entire workflow inside that jail, then tear it down afterwards?

[ChristopherHX]

If the runner receives a job it will execute a process with the arguments specified by --worker-args.

e.g.
--worker-args github-act-runner,worker
means start executable github-act-runner worker instead of running the job directly

--worker-args bash,myscript.sh

means start bash myscript.sh instead of running the job directly

myscript.sh could technically create a new jail and execute github-act-runner worker inside of the jail.

I'm not a docu writer, that caused the absense of it

Feel free to ask about unclear things.

[ChristopherHX]

A full run command would be

github-act-runner run --worker-args github-act-runner,worker
./run.sh --worker-args github-act-runner,worker

[ChristopherHX]

execute the entire workflow inside that jail,

This command is called every time a job starts. Not scoped workflow level.

then tear it down afterwards?

github-act-runner worker exits after the single job completes, it has access to.

If you would run the process in a blocking way inside a jail, I expect your script get's again control after the job is done and you can run commands to destroy/cleanup the jail.

I don't have experience with freebsd jail

For example the following should be able to use ssh as a tunnel to another machine, I believe jails can do the same without ssh.

github-act-runner run --worker-args ssh,host@testhost,github-act-runner,worker

_It's important that stdin get's piped into github-act-runner worker whereever it runs

[ChristopherHX]

I have just tried to setup that myself on freebsd (Except that I have to press f5 after the pot is running, due to a UI glitch)

setup

sudo pkg install curl pot
sudo pot init
curl -LO https://github.com/ChristopherHX/github-act-runner/releases/download/v0.6.8/binary-freebsd-amd64.tar.gz
mkdir runner
cd runner/
tar xf ../binary-freebsd-amd64.tar.gz
./config.sh

pot.sh

# create pot
name="pot-$(uuidgen)"
pot create -p "$name" -b 14.0 -t single -i hn0
pot copy-in -p "$name" -s github-act-runner -d /var/tmp
pot start -p "$name"
# run job in pot
pot exec -p "$name" /var/tmp/github-act-runner worker
code="$?"
# destroy pot
pot destroy -p "$name" -F
exit "$code"

The pot would need to install node (version 20) for most uses actions, for run steps this setup is enough

Now just run

./github-act-runner run --worker-args sudo,sh,pot.sh

The job itself runs inside the jail and directly connects to GitHub

Creating more docs about different technologies would make sense here