Skip to content

Commit 878c9b8

Browse files
milasmumoshu
milas
and
mumoshu
authored
runner: Use Docker socket via shared emptyDir instead of TCP/mTLS (actions#2324)
Co-authored-by: Yusuke Kuoka <[email protected]>
1 parent 4536707 commit 878c9b8

File tree

3 files changed

+143
-95
lines changed

3 files changed

+143
-95
lines changed

‎controllers/actions.summerwind.net/new_runner_pod_test.go‎

Lines changed: 64 additions & 52 deletions
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,12 @@ func TestNewRunnerPod(t *testing.T) {
7676
},
7777
},
7878
{
79-
Name: "certs-client",
79+
Name: "docker-sock",
8080
VolumeSource: corev1.VolumeSource{
81-
EmptyDir: &corev1.EmptyDirVolumeSource{},
81+
EmptyDir: &corev1.EmptyDirVolumeSource{
82+
Medium: corev1.StorageMediumMemory,
83+
SizeLimit: resource.NewScaledQuantity(1, resource.Mega),
84+
},
8285
},
8386
},
8487
},
@@ -137,15 +140,7 @@ func TestNewRunnerPod(t *testing.T) {
137140
},
138141
{
139142
Name: "DOCKER_HOST",
140-
Value: "tcp://localhost:2376",
141-
},
142-
{
143-
Name: "DOCKER_TLS_VERIFY",
144-
Value: "1",
145-
},
146-
{
147-
Name: "DOCKER_CERT_PATH",
148-
Value: "/certs/client",
143+
Value: "unix:///run/docker/docker.sock",
149144
},
150145
},
151146
VolumeMounts: []corev1.VolumeMount{
@@ -158,9 +153,8 @@ func TestNewRunnerPod(t *testing.T) {
158153
MountPath: "/runner/_work",
159154
},
160155
{
161-
Name: "certs-client",
162-
MountPath: "/certs/client",
163-
ReadOnly: true,
156+
Name: "docker-sock",
157+
MountPath: "/run/docker",
164158
},
165159
},
166160
ImagePullPolicy: corev1.PullAlways,
@@ -169,10 +163,15 @@ func TestNewRunnerPod(t *testing.T) {
169163
{
170164
Name: "docker",
171165
Image: "default-docker-image",
166+
Args: []string{
167+
"dockerd",
168+
"--host=unix:///run/docker/docker.sock",
169+
"--group=$(DOCKER_GROUP_GID)",
170+
},
172171
Env: []corev1.EnvVar{
173172
{
174-
Name: "DOCKER_TLS_CERTDIR",
175-
Value: "/certs",
173+
Name: "DOCKER_GROUP_GID",
174+
Value: "121",
176175
},
177176
},
178177
VolumeMounts: []corev1.VolumeMount{
@@ -181,8 +180,8 @@ func TestNewRunnerPod(t *testing.T) {
181180
MountPath: "/runner",
182181
},
183182
{
184-
Name: "certs-client",
185-
MountPath: "/certs/client",
183+
Name: "docker-sock",
184+
MountPath: "/run/docker",
186185
},
187186
{
188187
Name: "work",
@@ -485,9 +484,12 @@ func TestNewRunnerPod(t *testing.T) {
485484
},
486485
},
487486
{
488-
Name: "certs-client",
487+
Name: "docker-sock",
489488
VolumeSource: corev1.VolumeSource{
490-
EmptyDir: &corev1.EmptyDirVolumeSource{},
489+
EmptyDir: &corev1.EmptyDirVolumeSource{
490+
Medium: corev1.StorageMediumMemory,
491+
SizeLimit: resource.NewScaledQuantity(1, resource.Mega),
492+
},
491493
},
492494
},
493495
}
@@ -501,9 +503,8 @@ func TestNewRunnerPod(t *testing.T) {
501503
MountPath: "/runner",
502504
},
503505
{
504-
Name: "certs-client",
505-
MountPath: "/certs/client",
506-
ReadOnly: true,
506+
Name: "docker-sock",
507+
MountPath: "/run/docker",
507508
},
508509
}
509510
}),
@@ -527,9 +528,12 @@ func TestNewRunnerPod(t *testing.T) {
527528
},
528529
},
529530
{
530-
Name: "certs-client",
531+
Name: "docker-sock",
531532
VolumeSource: corev1.VolumeSource{
532-
EmptyDir: &corev1.EmptyDirVolumeSource{},
533+
EmptyDir: &corev1.EmptyDirVolumeSource{
534+
Medium: corev1.StorageMediumMemory,
535+
SizeLimit: resource.NewScaledQuantity(1, resource.Mega),
536+
},
533537
},
534538
},
535539
}
@@ -606,9 +610,12 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
606610
},
607611
},
608612
{
609-
Name: "certs-client",
613+
Name: "docker-sock",
610614
VolumeSource: corev1.VolumeSource{
611-
EmptyDir: &corev1.EmptyDirVolumeSource{},
615+
EmptyDir: &corev1.EmptyDirVolumeSource{
616+
Medium: corev1.StorageMediumMemory,
617+
SizeLimit: resource.NewScaledQuantity(1, resource.Mega),
618+
},
612619
},
613620
},
614621
},
@@ -667,15 +674,7 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
667674
},
668675
{
669676
Name: "DOCKER_HOST",
670-
Value: "tcp://localhost:2376",
671-
},
672-
{
673-
Name: "DOCKER_TLS_VERIFY",
674-
Value: "1",
675-
},
676-
{
677-
Name: "DOCKER_CERT_PATH",
678-
Value: "/certs/client",
677+
Value: "unix:///run/docker/docker.sock",
679678
},
680679
{
681680
Name: "RUNNER_NAME",
@@ -696,9 +695,8 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
696695
MountPath: "/runner/_work",
697696
},
698697
{
699-
Name: "certs-client",
700-
MountPath: "/certs/client",
701-
ReadOnly: true,
698+
Name: "docker-sock",
699+
MountPath: "/run/docker",
702700
},
703701
},
704702
ImagePullPolicy: corev1.PullAlways,
@@ -707,10 +705,15 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
707705
{
708706
Name: "docker",
709707
Image: "default-docker-image",
708+
Args: []string{
709+
"dockerd",
710+
"--host=unix:///run/docker/docker.sock",
711+
"--group=$(DOCKER_GROUP_GID)",
712+
},
710713
Env: []corev1.EnvVar{
711714
{
712-
Name: "DOCKER_TLS_CERTDIR",
713-
Value: "/certs",
715+
Name: "DOCKER_GROUP_GID",
716+
Value: "121",
714717
},
715718
},
716719
VolumeMounts: []corev1.VolumeMount{
@@ -719,8 +722,8 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
719722
MountPath: "/runner",
720723
},
721724
{
722-
Name: "certs-client",
723-
MountPath: "/certs/client",
725+
Name: "docker-sock",
726+
MountPath: "/run/docker",
724727
},
725728
{
726729
Name: "work",
@@ -1079,6 +1082,10 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
10791082
Name: "work",
10801083
MountPath: "/runner/_work",
10811084
},
1085+
{
1086+
Name: "docker-sock",
1087+
MountPath: "/run/docker",
1088+
},
10821089
},
10831090
},
10841091
},
@@ -1097,9 +1104,12 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
10971104
},
10981105
},
10991106
{
1100-
Name: "certs-client",
1107+
Name: "docker-sock",
11011108
VolumeSource: corev1.VolumeSource{
1102-
EmptyDir: &corev1.EmptyDirVolumeSource{},
1109+
EmptyDir: &corev1.EmptyDirVolumeSource{
1110+
Medium: corev1.StorageMediumMemory,
1111+
SizeLimit: resource.NewScaledQuantity(1, resource.Mega),
1112+
},
11031113
},
11041114
},
11051115
workGenericEphemeralVolume,
@@ -1110,13 +1120,12 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
11101120
MountPath: "/runner/_work",
11111121
},
11121122
{
1113-
Name: "runner",
1114-
MountPath: "/runner",
1123+
Name: "docker-sock",
1124+
MountPath: "/run/docker",
11151125
},
11161126
{
1117-
Name: "certs-client",
1118-
MountPath: "/certs/client",
1119-
ReadOnly: true,
1127+
Name: "runner",
1128+
MountPath: "/runner",
11201129
},
11211130
}
11221131
}),
@@ -1144,9 +1153,12 @@ func TestNewRunnerPodFromRunnerController(t *testing.T) {
11441153
},
11451154
},
11461155
{
1147-
Name: "certs-client",
1156+
Name: "docker-sock",
11481157
VolumeSource: corev1.VolumeSource{
1149-
EmptyDir: &corev1.EmptyDirVolumeSource{},
1158+
EmptyDir: &corev1.EmptyDirVolumeSource{
1159+
Medium: corev1.StorageMediumMemory,
1160+
SizeLimit: resource.NewScaledQuantity(1, resource.Mega),
1161+
},
11501162
},
11511163
},
11521164
workGenericEphemeralVolume,

0 commit comments

Comments
 (0)