Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

Earn badges and make progress

You're on your way to the next level! Join the Kudos program to earn points and save your progress.

Deleted user Avatar
Deleted user

Level 1: Seed

25 / 150 points

Next: Root


1 badge earned


Participate in fun challenges

Challenges come and go, but your rewards stay with you. Do more to earn more!


Gift kudos to your peers

What goes around comes around! Share the love by gifting kudos to your peers.


Rise up in the ranks

Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!


Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
Community Members
Community Events
Community Groups

Self-hosted shell runner - pass configuration securely

After the introduction of self-hosted shell runners, we immediately switched from the previous Docker runners to shell runners running inside Docker containers, so we can have a simple way to deploy to our Swarm cluster (by having the deployment image running inside it, with access to the Docker socket on the host). Essentially, we're just running a pipelines runner with access to the Docker swarm host.

What bugs me, however, is that the runner script requires secret credentials to be passed as command line parameters:

/runner/bin/ \
--accountUuid "$(cat /run/secrets/account_uuid)" \
--runnerUuid "$(cat /run/secrets/runner_uuid)" \
--OAuthClientId "$(cat /run/secrets/oauth_client_id)" \
--OAuthClientSecret "$(cat /run/secrets/oauth_client_secret)" \
--runtime linux-shell \
--workingDirectory /build

By inspecting the current process list, the full prompt of the running process is exposed, thus displaying the secrets in plain text to any interested party:

moritz@whale-01 ~> sudo ps -aux | grep runner
root 1225126 79.0 1.5 2549580 60704 ? Sl 06:48 0:00 java -jar -Dbitbucket.pipelines.runner.account.uuid=<REDACTED> -Dbitbucket.pipelines.runner.repository.uuid= -Dbitbucket.pipelines.runner.uuid=<REDACTED><REDACTED> -Dbitbucket.pipelines.runner.oauth.client.secret=<REDACTED> -Dbitbucket.pipelines.runner.environment=PRODUCTION -Dbitbucket.pipelines.runner.runtime=linux-shell -Dbitbucket.pipelines.runner.docker.uri= -Dbitbucket.pipelines.runner.scheduled.state.update.initial.delay.seconds=0 -Dbitbucket.pipelines.runner.scheduled.state.update.period.seconds=30 -Dbitbucket.pipelines.runner.cleanup.previous.folders=false -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=UTF-8 ./runner.jar

As there is no way to pass configuration via config files or environment variables, there is no way for me to protect the runner credentials from other processes or malicious employees.

@ Atlassian, can you please revise the way the runner script works?

1 answer

0 votes
Theodora Boudale
Atlassian Team
Atlassian Team members are employees working across the company in a wide variety of roles.
Sep 02, 2022

Hi Moritz,

I reached out to our development team about your request.

Even if credentials are passed as environment variables or in a file, they will still be visible if you run sudo ps -aux | grep runner, and other users could still access the variables and files. This is not a problem that is solvable by us.

If you are concerned about security, you can configure the host to not allow other users onto the machine or restrict what users can see.

Kind regards,

Suggest an answer

Log in or Sign up to answer
Site Admin
AUG Leaders

Atlassian Community Events