test: run every job on default without root, add a security check and BuildKit #2

Merged

info merged 3 commits from nonroot into main 2026-10-26 20:13:40 +00:00

Conversation 1 Commits 3 Files changed 11 +154 -22

uberadmin commented 2026-10-26 19:50:24 +00:00

Contributor

Copy link

The Kubernetes executor runs no job as root (ADR 0018). The runner change is https://gitlab.com/digilab.overheid.nl/platform/flux/core/-/merge_requests/1180. Merge this pull request after that change is on digikluster.

What changes

• 00-security-context.yml is new. It checks the uid, the capabilities, no-new-privileges, seccomp, the service account token and the network path to the Kubernetes API.
• 05a and 05b (kaniko) move to the label vm and start by hand. kaniko needs uid 0.
• 05d-image-buildkit.yml is new. It tries rootless BuildKit instead of kaniko. The label is an input.
• 04 and 06 set PGDATA: /tmp/pgdata. The default PGDATA belongs to uid 999.
• 07, 11 and 12 install no packages. They use images that have the tools, and put crane in /tmp/bin.
• The README has the rules for the label default.

Results on the current runner (root), 2026-10-26

• All push workflows pass, except 00. 00 fails with uid=0(root), as expected.
• 05d on default fails: max_user_namespaces needs to be set to non-zero, then fork/exec /proc/self/exe: operation not permitted.

Run all workflows on this branch again after the runner change. 00 must then pass.

The Kubernetes executor runs no job as root (ADR 0018). The runner change is https://gitlab.com/digilab.overheid.nl/platform/flux/core/-/merge_requests/1180. Merge this pull request after that change is on digikluster. ## What changes - `00-security-context.yml` is new. It checks the uid, the capabilities, no-new-privileges, seccomp, the service account token and the network path to the Kubernetes API. - `05a` and `05b` (kaniko) move to the label `vm` and start by hand. kaniko needs uid 0. - `05d-image-buildkit.yml` is new. It tries rootless BuildKit instead of kaniko. The label is an input. - `04` and `06` set `PGDATA: /tmp/pgdata`. The default `PGDATA` belongs to uid 999. - `07`, `11` and `12` install no packages. They use images that have the tools, and put crane in `/tmp/bin`. - The README has the rules for the label `default`. ## Results on the current runner (root), 2026-10-26 - All push workflows pass, except `00`. `00` fails with `uid=0(root)`, as expected. - `05d` on `default` fails: `max_user_namespaces needs to be set to non-zero`, then `fork/exec /proc/self/exe: operation not permitted`. Run all workflows on this branch again after the runner change. `00` must then pass.

uberadmin added 1 commit 2026-10-26 19:50:24 +00:00

test: run every job on default without root, add a security check and BuildKit ... 58c75a006c

The Kubernetes executor runs no job as root (ADR 0018). Each job and each service
container runs as uid 1000 with no capabilities.

- 00 checks the uid, the capabilities, no-new-privileges, seccomp, the service account
  token and the network path to the Kubernetes API.
- 05a and 05b move to the label vm. kaniko needs uid 0.
- 05d tries rootless BuildKit instead of kaniko.
- 04 and 06 set PGDATA, because the default PGDATA belongs to uid 999.
- 07, 11 and 12 install no packages. They use images that have the tools.

uberadmin commented 2026-10-26 19:57:17 +00:00

Author

Contributor

Copy link

Results after platform/flux/core!1180, 2026-10-26, on the organisation runner digikluster-k8s-forgejo:

• 00: passes. uid=1000 gid=1000, CapPrm, CapEff and CapBnd are 0, NoNewPrivs: 1, Seccomp: 2, no token, the Kubernetes API and 169.254.169.254 are blocked.
• 01 to 04, 05c, 06 to 12: all pass. The PostgreSQL service of 06 starts as uid 1000 with PGDATA: /tmp/pgdata.
• 05d on default: fails as expected. user.max_user_namespaces: 0, then fork/exec /proc/self/exe: operation not permitted.

This pull request can merge.

Results after platform/flux/core!1180, 2026-10-26, on the organisation runner `digikluster-k8s-forgejo`: - `00`: passes. `uid=1000 gid=1000`, `CapPrm`, `CapEff` and `CapBnd` are 0, `NoNewPrivs: 1`, `Seccomp: 2`, no token, the Kubernetes API and `169.254.169.254` are blocked. - `01` to `04`, `05c`, `06` to `12`: all pass. The PostgreSQL service of `06` starts as uid 1000 with `PGDATA: /tmp/pgdata`. - `05d` on `default`: fails as expected. `user.max_user_namespaces: 0`, then `fork/exec /proc/self/exe: operation not permitted`. This pull request can merge.

uberadmin added 1 commit 2026-10-26 19:58:51 +00:00

test: make the runner label of 05a an input 868add31b7

uberadmin added 1 commit 2026-10-26 20:06:47 +00:00

test: note that BuildKit needs root or user namespaces 52a84d9d09

info merged commit 52a84d9d09 into main 2026-10-26 20:13:40 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels

No items

No labels

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

forgejo/runner-tests!2

No description provided.