didericis-codex
72e35a1343
test / integration-docker (pull_request) Successful in 13s
tracker-policy-pr / check-pr (pull_request) Successful in 11s
test / unit (pull_request) Successful in 37s
test / stage-firecracker-inputs (pull_request) Successful in 2s
lint / lint (push) Successful in 2m44s
test / build-infra (pull_request) Successful in 3m38s
test / integration-firecracker (pull_request) Successful in 2m7s
test / coverage (pull_request) Failing after 1m59s
test / publish-infra (pull_request) Has been skipped
Add an opt-in docker_access path that layers rootless Docker tooling onto the selected agent image, starts the daemon only after registration, and retains the existing outer network and capability boundary. Include fail-closed bootstrap checks plus a live-Mac Compose/security acceptance test.\n\nRefs #392.
58 lines
1.6 KiB
Bash
58 lines
1.6 KiB
Bash
#!/bin/sh
|
|
set -eu
|
|
|
|
uid="$(id -u)"
|
|
if [ "$uid" -eq 0 ]; then
|
|
echo "refusing to run rootless Docker as root" >&2
|
|
exit 1
|
|
fi
|
|
|
|
for command in dockerd-rootless.sh rootlesskit slirp4netns newuidmap newgidmap docker; do
|
|
command -v "$command" >/dev/null 2>&1 || {
|
|
echo "missing rootless Docker prerequisite: $command" >&2
|
|
exit 1
|
|
}
|
|
done
|
|
|
|
grep -q "^$(id -un):.*:65536$" /etc/subuid || {
|
|
echo "missing 65536-entry subordinate UID range for $(id -un)" >&2
|
|
exit 1
|
|
}
|
|
grep -q "^$(id -gn):.*:65536$" /etc/subgid || {
|
|
echo "missing 65536-entry subordinate GID range for $(id -gn)" >&2
|
|
exit 1
|
|
}
|
|
|
|
export XDG_RUNTIME_DIR="${XDG_RUNTIME_DIR:-/tmp/bot-bottle-docker-run}"
|
|
mkdir -p "$XDG_RUNTIME_DIR" "$HOME/.docker"
|
|
chmod 700 "$XDG_RUNTIME_DIR"
|
|
|
|
# Docker uses this config for build and child-container proxy injection. The
|
|
# token-bearing proxy URL is already available to the agent; persisting it
|
|
# inside this disposable VM does not broaden its authority.
|
|
python3 - <<'PY'
|
|
import json
|
|
import os
|
|
from pathlib import Path
|
|
|
|
proxy = os.environ.get("HTTPS_PROXY") or os.environ.get("https_proxy", "")
|
|
no_proxy = os.environ.get("NO_PROXY") or os.environ.get("no_proxy", "")
|
|
config = {"proxies": {"default": {
|
|
"httpProxy": proxy,
|
|
"httpsProxy": proxy,
|
|
"noProxy": no_proxy,
|
|
}}}
|
|
path = Path.home() / ".docker" / "config.json"
|
|
path.write_text(json.dumps(config), encoding="utf-8")
|
|
path.chmod(0o600)
|
|
PY
|
|
|
|
if docker info >/dev/null 2>&1; then
|
|
exit 0
|
|
fi
|
|
|
|
log=/tmp/bot-bottle-rootless-docker.log
|
|
nohup dockerd-rootless.sh \
|
|
--storage-driver=fuse-overlayfs \
|
|
>"$log" 2>&1 </dev/null &
|