ci: harden production quality gates

2026-07-17 14:23:49 +08:00
parent db85487b73
commit 91ea0e6a2d
15 changed files with 1023 additions and 252 deletions
@@ -0,0 +1,43 @@
+[Unit]
+Description=EasyAI AI Gateway rootless DinD Gitea Actions runner v2
+Requires=docker.service
+After=network-online.target docker.service
+Wants=network-online.target
+
+[Service]
+Type=simple
+User=root
+Group=root
+Environment=RUNNER_SECURITY_OPTIONS=
+EnvironmentFile=-/etc/easyai-gateway-ci-v2/runner.env
+ExecStartPre=-/usr/bin/docker rm --force easyai-gateway-ci-v2-runner
+ExecStart=/usr/bin/docker run --rm --pull=never --name easyai-gateway-ci-v2-runner --privileged --pids-limit 4096 $RUNNER_SECURITY_OPTIONS --volume easyai-gateway-ci-v2-data:/data --volume /etc/easyai-gateway-ci-v2/config.yaml:/config.yaml:ro --volume /opt/easyai-gateway-ci:/opt/easyai-gateway-ci:ro --env CONFIG_FILE=/config.yaml --env DOCKERD_ROOTLESS_ROOTLESSKIT_NET=slirp4netns --env DOCKERD_ROOTLESS_ROOTLESSKIT_MTU=65520 --env DOCKERD_ROOTLESS_ROOTLESSKIT_FLAGS=--pidns docker.io/gitea/runner:2.0.0-dind-rootless@sha256:5b7b625ff773d0ee761788c47582503ec1b241fa5b81edebad48a57e663f4f3a
+ExecStop=-/usr/bin/docker stop --time 360 easyai-gateway-ci-v2-runner
+Restart=always
+RestartSec=5s
+TimeoutStartSec=60s
+TimeoutStopSec=390s
+
+# systemd only launches the host Docker client. Pull-request jobs run inside the
+# nested rootless daemon and never receive the host or nested Docker socket.
+NoNewPrivileges=true
+CapabilityBoundingSet=
+AmbientCapabilities=
+PrivateTmp=true
+PrivateDevices=true
+ProtectSystem=strict
+ProtectHome=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectKernelLogs=true
+ProtectControlGroups=true
+ProtectClock=true
+ProtectHostname=true
+LockPersonality=true
+RestrictRealtime=true
+RestrictSUIDSGID=true
+SystemCallArchitectures=native
+UMask=0077
+
+[Install]
+WantedBy=multi-user.target