26 lines
1.1 KiB
YAML
26 lines
1.1 KiB
YAML
# act_runner (the forgejo-runner binary) ships no config.yaml by default, so
|
|
# `forgejo-runner daemon` runs on its hardcoded defaults -- notably
|
|
# container.valid_volumes: [] ("if the sequence is empty, no volumes can be
|
|
# mounted"). Confirmed via `forgejo-runner generate-config` on this exact
|
|
# image (code.forgejo.org/forgejo/runner:6) and by running the daemon against
|
|
# a minimal override locally: a job container that requests any bind mount
|
|
# (e.g. the dind mTLS certs at /docker-certs/client, needed for
|
|
# `docker login`/build/push steps) is rejected outright with no default
|
|
# config in place.
|
|
#
|
|
# Scoped narrowly to exactly the certs path, read-only. Not a wildcard
|
|
# (valid_volumes: ['**']) -- that would let any workflow in any repo this
|
|
# runner serves bind-mount arbitrary paths off the runner pod's filesystem
|
|
# into a job container, which is a real widening of the CI trust boundary,
|
|
# not just a convenience.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: {{ .Release.Name }}-config
|
|
namespace: {{ .Release.Namespace }}
|
|
data:
|
|
config.yaml: |
|
|
container:
|
|
valid_volumes:
|
|
- /docker-certs/client
|