Skip to content

Add CI runner hardening audit #704

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
arussell-nvidia wants to merge 2 commits into
base: main
Choose a base branch
from
+79 −0
Open

Add CI runner hardening audit #704

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8e28141
Add CI runner hardening audit
arussell-nvidia Jun 24, 2026
de5fbc7
Cover alternate Docker socket path
arussell-nvidia Jun 24, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
79 changes: 79 additions & 0 deletions .github/workflows/ci-runner-hardening.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,79 @@
# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
# SPDX-License-Identifier: Apache-2.0

name: CI Runner Hardening Audit

on:
pull_request:
push:
branches: [ main, 'release/*.*.x' ]
workflow_dispatch:

concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: ${{ github.event_name == 'pull_request' }}

jobs:
docker-host-access-audit:
name: Docker host access audit
runs-on: ubuntu-22.04
permissions:
contents: read
timeout-minutes: 5

steps:
- name: Checkout code
# actions/checkout@v6
uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10
with:
persist-credentials: false

- name: Reject privileged Docker host access in CI config
shell: bash
run: |
set -euo pipefail

files=()
while IFS= read -r -d '' file; do
files+=("$file")
done < <(
find .github/workflows .github/actions \
-type f \( -name '*.yml' -o -name '*.yaml' \) \
! -path '.github/workflows/ci-runner-hardening.yml' \
-print0
)

if [[ -f .gitlab-ci.yml ]]; then
files+=(".gitlab-ci.yml")
fi

if (( ${#files[@]} == 0 )); then
echo "No CI config files found to audit."
exit 0
fi

tmp_patterns="$(mktemp)"
cat > "${tmp_patterns}" <<'PATTERNS'
--privileged
/var/run/docker.sock
/run/docker.sock
docker.sock:
docker.sock=
docker.sock/
privileged: true
DOCKER_HOST=unix://
DOCKER_HOST: unix://
PATTERNS
Comment on lines +57 to +66

@coderabbitai coderabbitai Bot Jun 24, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🔒 Security & Privacy | 🟠 Major | ⚡ Quick win

Add /run/docker.sock to deny patterns to prevent audit bypass.

The audit currently blocks /var/run/docker.sock but misses /run/docker.sock, which allows equivalent Docker host socket access to pass undetected.

Suggested patch 
         --privileged
         /var/run/docker.sock
+        /run/docker.sock
         docker.sock:
         docker.sock=
         docker.sock/

As per path instructions, .github/workflows/**: “Focus on security (secret handling, permissions) and correctness of build/test steps.”

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change
--privileged
/var/run/docker.sock
docker.sock:
docker.sock=
docker.sock/
privileged: true
DOCKER_HOST=unix://
DOCKER_HOST: unix://
PATTERNS
--privileged
/var/run/docker.sock
/run/docker.sock
docker.sock:
docker.sock=
docker.sock/
privileged: true
DOCKER_HOST=unix://
DOCKER_HOST: unix://
PATTERNS
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/ci-runner-hardening.yml around lines 57 - 65, The
deny-pattern list in the CI hardening workflow is missing the equivalent Docker
socket path, so audit checks can be bypassed via /run/docker.sock. Update the
pattern set used by the workflow’s socket-blocking/audit logic to include
/run/docker.sock alongside the existing /var/run/docker.sock entry, keeping the
change in the same denylist section that references docker.sock and DOCKER_HOST
patterns.

Source: Path instructions

@arussell-nvidia arussell-nvidia Jun 24, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Fixed in de5fbc7: added /run/docker.sock to the denylist next to /var/run/docker.sock so the audit catches both common Docker socket paths.


matches="$(grep -nFif "${tmp_patterns}" -- "${files[@]}" || true)"
rm -f "${tmp_patterns}"

if [[ -n "${matches}" ]]; then
echo "Found CI configuration that grants Docker host-level access:"
echo "${matches}"
echo
echo "Use a daemonless builder or a least-privilege runner instead of privileged Docker or Docker socket mounts."
exit 1
fi

echo "No privileged Docker or Docker socket CI configuration found."
Loading