running DID with privileged: false

[roshvin]

Hi,
i was referring to https://github.com/some-natalie/kubernoodles/blob/main/deployments/ghes/rootless-ubuntu-focal.yml and tryign to start Docker inside runner , but our kubernetes cluster policy wont allow running container in prevailed mode .

could you pls suggest any alternative solution / option to run docker or podman with privileged: false option.

2022-09-21T16:07:20Z ERROR Reconciler error {"controller": "runner-controller", "controllerGroup": "actions.summerwind.dev", "controllerKind": "Runner", "runner": {"name":"rootless-ubuntu-focal-s79gm-nznk2","namespace":"actions-runner-system"}, "namespace": "actions-runner-system", "name": "rootless-ubuntu-focal-s79gm-nznk2", "reconcileID": "b8cc10ad-7d9a-4a2a-ab13-4bef0dda41d7", "error": "pods "rootless-ubuntu-focal-s79gm-nznk2" is forbidden: PodSecurityPolicy: unable to admit pod: [spec.containers[0].securityContext.privileged: Invalid value: true: Privileged containers are not allowed]"}

[some-natalie]

Docker-in-Docker relies on --privileged execution to mount procfs and sysfs, regardless of if the account used within the pod has root access or not. Running the rootless container provides an additional layer of security by disallowing privileged execution within the pod and running the nested Docker instance in rootless mode, but the runner pod is still privileged.

ℹ️ All pods in this project use Docker-in-Docker (or Podman-in-Podman).

If that's not an option, there's a couple other options within actions-runner-controller that might work better for you:

• Runners with K8S jobs - link
• The default ARC runner does not support Docker-in-Docker, thus doesn't require privileged pods

You can also use Docker from a persistent virtual machine in rootless mode, but that means you're not using actions-runner-controller. Here's the docs on the requirements there.

Learn more:

• An issue from Docker discussing why that's the case.
• The pull request adding a rootless runner to ARC has some good discussion on the differences between privileged pods and root access inside the pod.

[roshvin]

Hi @some-natalie thanks a lot for your quick replay and contribution towards action runner controller . i got your contact from the latest action runnner controller release note. :)