You're on your way to the next level! Join the Kudos program to earn points and save your progress.
Level 1: Seed
25 / 150 points
1 badge earned
Challenges come and go, but your rewards stay with you. Do more to earn more!
What goes around comes around! Share the love by gifting kudos to your peers.
Keep earning points to reach the top of the leaderboard. It resets every quarter so you always have a chance!
Join now to unlock these features and more
After the introduction of self-hosted shell runners, we immediately switched from the previous Docker runners to shell runners running inside Docker containers, so we can have a simple way to deploy to our Swarm cluster (by having the deployment image running inside it, with access to the Docker socket on the host). Essentially, we're just running a pipelines runner with access to the Docker swarm host.
What bugs me, however, is that the runner script requires secret credentials to be passed as command line parameters:
--accountUuid "$(cat /run/secrets/account_uuid)" \
--runnerUuid "$(cat /run/secrets/runner_uuid)" \
--OAuthClientId "$(cat /run/secrets/oauth_client_id)" \
--OAuthClientSecret "$(cat /run/secrets/oauth_client_secret)" \
--runtime linux-shell \
By inspecting the current process list, the full prompt of the running process is exposed, thus displaying the secrets in plain text to any interested party:
moritz@whale-01 ~> sudo ps -aux | grep runner
root 1225126 79.0 1.5 2549580 60704 ? Sl 06:48 0:00 java -jar -Dbitbucket.pipelines.runner.account.uuid=<REDACTED> -Dbitbucket.pipelines.runner.repository.uuid= -Dbitbucket.pipelines.runner.uuid=<REDACTED> -Dbitbucket.pipelines.runner.oauth.client.id=<REDACTED> -Dbitbucket.pipelines.runner.oauth.client.secret=<REDACTED> -Dbitbucket.pipelines.runner.directory.working=/build -Dbitbucket.pipelines.runner.environment=PRODUCTION -Dbitbucket.pipelines.runner.runtime=linux-shell -Dbitbucket.pipelines.runner.docker.uri= -Dbitbucket.pipelines.runner.scheduled.state.update.initial.delay.seconds=0 -Dbitbucket.pipelines.runner.scheduled.state.update.period.seconds=30 -Dbitbucket.pipelines.runner.cleanup.previous.folders=false -Dfile.encoding=UTF-8 -Dsun.jnu.encoding=UTF-8 ./runner.jar
As there is no way to pass configuration via config files or environment variables, there is no way for me to protect the runner credentials from other processes or malicious employees.
@ Atlassian, can you please revise the way the runner script works?
I reached out to our development team about your request.
Even if credentials are passed as environment variables or in a file, they will still be visible if you run sudo ps -aux | grep runner, and other users could still access the variables and files. This is not a problem that is solvable by us.
If you are concerned about security, you can configure the host to not allow other users onto the machine or restrict what users can see.