Page MenuHomePhabricator

Evaluate if Docker can be executed as non-root on Trusted Runners
Closed, DeclinedPublic


In the setup of Trusted Runners T295481 the idea came up to run the Docker executor on Trusted Runners with less privileges. This dedicated task is about running the Docker executor as non-root and with disabled sudo/dropped SETUID and SETGID capabilities (like the docs recommend for more security hardening).

This feature is not strictly needed to open Trusted Runners to the public but could enhance the security even more. Both the security improvements but also the added restrictions to CI jobs should be evaluated.

See also:

Event Timeline

Change 773746 had a related patch set uploaded (by Jelto; author: Jelto):

[operations/puppet@production] gitlab_runner: add option to drop Docker capabilities

Change 773746 abandoned by Jelto:

[operations/puppet@production] gitlab_runner: add option to drop Docker capabilities


not needed at the moment

LSobanski subscribed.

The cost of implementing this would not be comparable to the gains.