From fca6b44c607b6efea2c71df0baf189ab3a2c5d1a Mon Sep 17 00:00:00 2001 From: silverwind Date: Wed, 2 Sep 2026 20:32:41 +0000 Subject: [PATCH] fix: automatically add the workspace mount to allowed volumes (#1203) Automatically allow workspace mounts in `valid_volumes` for the mounts done via `bind_workdir`, this obsoletes the need for `/workspace/**` or other insecure configurations which would expose workspaces between tasks. Reviewed-on: https://gitea.com/gitea/runner/pulls/1203 Reviewed-by: bircni Co-authored-by: silverwind --- act/runner/run_context.go | 3 +++ act/runner/run_context_test.go | 5 +++++ internal/pkg/config/config.example.yaml | 2 +- 3 files changed, 9 insertions(+), 1 deletion(-) diff --git a/act/runner/run_context.go b/act/runner/run_context.go index 8c99902a..0f17095b 100644 --- a/act/runner/run_context.go +++ b/act/runner/run_context.go @@ -246,6 +246,9 @@ func (rc *RunContext) validVolumes() []string { if rc.Config.SharedToolCache { volumes = append(volumes, sharedToolCacheVolume) } + if rc.Config.BindWorkdir { + volumes = append(volumes, rc.Config.Workdir) + } // TODO: add a new configuration to control whether the docker daemon can be mounted return append(volumes, name, name+"-env", getDockerDaemonSocketMountPath(rc.containerDaemonSocket())) diff --git a/act/runner/run_context_test.go b/act/runner/run_context_test.go index a10c9653..cded68b3 100644 --- a/act/runner/run_context_test.go +++ b/act/runner/run_context_test.go @@ -604,6 +604,11 @@ func TestRunContextValidVolumes(t *testing.T) { // a job may mount it only while the runner does rc.Config.SharedToolCache = false assert.NotContains(t, rc.validVolumes(), sharedToolCacheVolume) + + rc.Config.Workdir = "/workspace/1/owner/repo" + assert.NotContains(t, rc.validVolumes(), rc.Config.Workdir) + rc.Config.BindWorkdir = true + assert.Contains(t, rc.validVolumes(), rc.Config.Workdir) } func TestCleanupJobResourcesCleansServicesWithoutJobContainer(t *testing.T) { diff --git a/internal/pkg/config/config.example.yaml b/internal/pkg/config/config.example.yaml index 34575127..7ade6668 100644 --- a/internal/pkg/config/config.example.yaml +++ b/internal/pkg/config/config.example.yaml @@ -260,7 +260,7 @@ container: # This is required for Docker-in-Docker (DinD) setups when jobs use docker compose # with bind mounts (e.g., ".:/app"), as volume-based workspaces are not accessible # from the DinD daemon's filesystem. When enabled, ensure the workspace parent - # directory is also mounted into the runner container and listed in valid_volumes. + # directory is also mounted into the runner container. #bind_workdir: false # How long a job waits for a service container that declares a healthcheck to become # healthy. A negative value (e.g. -1s) starts the steps without waiting.