BCAI/easyai-ai-gateway
3
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(ci): verify rootless pid namespace without proc links
Some checks failed
ci / verify (pull_request) Failing after 6m9s
Details

Browse Source
This commit is contained in:
chengcheng 2026-07-17 15:15:55 +08:00
parent 06f95c5d86
commit 5e8fb4276f
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
scripts/provision-ci-runner.sh
View File

@ -270,11 +270,18 @@ docker exec "$PROBE_CONTAINER" docker info --format '{{range .SecurityOptions}}{
# Complete every slow and capability-sensitive validation before registration;
# otherwise a queued workflow can race the installer for the same image layers.
docker exec "$PROBE_CONTAINER" docker pull "$JOB_IMAGE"
outer_pidns=$(docker exec "$PROBE_CONTAINER" readlink /proc/1/ns/pid)
inner_host_pidns=$(docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
--pid=host --entrypoint readlink "$JOB_IMAGE" /proc/1/ns/pid)
[ "$outer_pidns" != "$inner_host_pidns" ] || \
outer_sentinel_pid=$(docker exec "$PROBE_CONTAINER" /bin/sh -c \
'sleep 300 >/dev/null 2>&1 & printf "%s\n" "$!"')
case $outer_sentinel_pid in
'' | *[!0-9]*) fail "could not create the outer PID namespace sentinel" ;;
esac
if ! docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
--pid=host --entrypoint /bin/sh "$JOB_IMAGE" \
-ec 'test ! -e "/proc/$1"' sh "$outer_sentinel_pid"; then
docker exec "$PROBE_CONTAINER" kill "$outer_sentinel_pid" >/dev/null 2>&1 || true
fail "nested --pid=host can see the outer runner PID namespace"
fi
docker exec "$PROBE_CONTAINER" kill "$outer_sentinel_pid" >/dev/null 2>&1 || true
docker exec "$PROBE_CONTAINER" docker run --rm --pull=never \
--volume "$PREFIX:$PREFIX:ro" \
--entrypoint /bin/sh "$JOB_IMAGE" -ec '