Get GitHub Docker Actions working (securely)

ploigos / infra-ops

GitOps repository for the infrastructure that contributors use to develop and test the Ploigos ecosystem

Apache License 2.0

0 stars 1 forks source link

Get GitHub Docker Actions working (securely) #52

Open dwinchell opened 2 years ago

dwinchell commented 2 years ago

Success Criteria:

There is a green test (throwaway) pipeline that uses a Docker Action and our self-hosted runner on OpenShift
The GitHub runner still uses a ubi8-based base image
The GitHub runner starts containers using podman
The started, "child" containers run "rootless" but "think" they are the root user.

Notes:

See the "kubernoodles" project on github (Natalie from GitHub created it and in our prior convo suggested we look at it)

jthompkins commented 2 years ago

When time permits we should revisit with new information regarding cluster role / scc link in mind. Possibly did not have a cluster role for the nonrootbuilder-docker?

dwinchell commented 2 years ago

There's an issue about this in the kubernoodles project
If needed we can ask to open a ticket about this with GitHub

aktech commented 2 years ago

Disclaimer: This doesn't answers the actual question, but suggests an alternative:

You can achieve this easily with https://cirun.io/ It creates on demand runners for GitHub Actions on your cloud and manages the complete lifecycle. You simply connect your cloud provider and define what runners you need in a simple yaml file and that's it. It also works on OpenStack.

See https://docs.cirun.io/reference/examples.html#aws for example.