Context
Self hosted docker linux runners created with the given command are creating root owned files in /tmp.
/tmp is the WORKSPACE directory.
This is a security issue as this files could lead to permission escalation when in my pipeline is a script which can damage the host. This script can be executed with root rights on the host when the attacker is on the host system.
What did I try to prevent:
- used a docker volume so that the WORKSPACE directory is not created on HOST.
Result: Did not work as it seems that all of the created docker container from one runner will access those shared /tmp sources
Suggestion: Fix this in the pipelines runner container to use a shared volume -> easier and without security issues - set the user and group ID of the executing user to your host users ID
Result: Access denied on the docker sockets mounted in the container because the containers created by the runner do now inherit this USER ID
Suggestion: Runner should use the USERID of itself to create the child containers
I guess the reason for this is the access to the shared /tmp folder.
Suggestion: Use a anonym docker volume and use it as shared one between the sub containers. Or at least give us the option to do
Anyone have better ideas?
