Skip to content

Commit fffc634

Browse files
frezbofrezbo
committed
feat: build runner image from source
Build actions runner image using source Dockerfile with our own modifications. This adds the extra required packages and updates Ubuntu version to a more reasonale modern one. Signed-off-by: Noel Georgi <[email protected]>
1 parent 0a0270d commit fffc634

File tree

6 files changed

+213
-62
lines changed

6 files changed

+213
-62
lines changed

‎.github/renovate.json‎

Lines changed: 16 additions & 25 deletions
Original file line numberDiff line numberDiff line change
@@ -1,55 +1,46 @@
11
{
22
"$schema": "https://docs.renovatebot.com/renovate-schema.json",
3+
"description": "THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.",
4+
"prHeader": "Update Request | Renovate Bot",
35
"extends": [
46
":dependencyDashboard",
57
":gitSignOff",
68
":semanticCommitScopeDisabled",
79
"schedule:earlyMondays"
810
],
9-
"prHeader": "Update Request | Renovate Bot",
1011
"customManagers": [
1112
{
1213
"customType": "regex",
14+
"versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}",
1315
"fileMatch": [
1416
"^Dockerfile$"
1517
],
1618
"matchStrings": [
1719
"#\\s+renovate:\\s+datasource=(?<datasource>.*?)\\s+depName=(?<depName>.*?)(?:\\s+versioning=(?<versioning>.*?))?(?:\\s+extractVersion=(?<extractVersion>.*?))?\\sARG\\s+.*?_VERSION=(?<currentValue>.*)"
18-
],
19-
"versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
20+
]
2021
},
2122
{
2223
"customType": "regex",
24+
"versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}",
2325
"fileMatch": [
2426
"^hack/scripts/setup-"
2527
],
2628
"matchStrings": [
27-
"#\\s+renovate:\\s+datasource=(?<datasource>.*?)\\s+depName=(?<depName>.*?)(?:\\s+versioning=(?<versioning>.*?))?(?:\\s+extractVersion=(?<extractVersion>.*?))?\\sBUILDKIT_IMAGE=\".+:(?<currentValue>.*)\""
28-
],
29-
"versioningTemplate": "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
29+
"#\\s+renovate:\\s+datasource=(?<datasource>.*?)\\s+depName=(?<depName>.*?)(?:\\s+versioning=(?<versioning>.*?))?(?:\\s+extractVersion=(?<extractVersion>.*?))?\\sBUILDKIT_IMAGE=\\\".+:(?<currentValue>.*)\\\""
30+
]
3031
}
3132
],
3233
"packageRules": [
3334
{
34-
"matchDatasources": [
35-
"docker"
36-
],
37-
"groupName": "container images",
38-
"matchPackageNames": [
39-
"*"
40-
]
41-
},
42-
{
43-
"matchDatasources": [
44-
"git-refs",
45-
"git-tags",
46-
"github-tags",
47-
"github-releases"
48-
],
49-
"groupName": "releases",
50-
"matchPackageNames": [
51-
"*"
35+
"groupName": "dependencies",
36+
"matchUpdateTypes": [
37+
"major",
38+
"minor",
39+
"patch",
40+
"pin",
41+
"digest"
5242
]
5343
}
54-
]
44+
],
45+
"separateMajorMinor": false
5546
}

‎.github/workflows/slack-notify.yaml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# THIS FILE WAS AUTOMATICALLY GENERATED, PLEASE DO NOT EDIT.
22
#
3-
# Generated on 2024-07-01T07:41:11Z by kres 4c9f215.
3+
# Generated on 2025-02-17T17:00:14Z by kres 8a48729.
44

55
name: slack-notify
66
"on":
@@ -24,11 +24,12 @@ jobs:
2424
run: |
2525
echo pull_request_number=$(gh pr view -R ${{ github.repository }} ${{ github.event.workflow_run.head_repository.owner.login }}:${{ github.event.workflow_run.head_branch }} --json number --jq .number) >> $GITHUB_OUTPUT
2626
- name: Slack Notify
27-
uses: slackapi/slack-github-action@v1
27+
uses: slackapi/slack-github-action@v2
2828
with:
29-
channel-id: proj-talos-maintainers
29+
method: chat.postMessage
3030
payload: |
3131
{
32+
"channel": "proj-talos-maintainers",
3233
"attachments": [
3334
{
3435
"color": "${{ github.event.workflow_run.conclusion == 'success' && '#2EB886' || github.event.workflow_run.conclusion == 'failure' && '#A30002' || '#FFCC00' }}",
@@ -88,5 +89,4 @@ jobs:
8889
}
8990
]
9091
}
91-
env:
92-
SLACK_BOT_TOKEN: ${{ secrets.SLACK_BOT_TOKEN }}
92+
token: ${{ secrets.SLACK_BOT_TOKEN }}

‎.kres.yaml‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -28,3 +28,19 @@ spec:
2828
command: make
2929
environment:
3030
PUSH: true
31+
---
32+
kind: common.Renovate
33+
spec:
34+
customManagers:
35+
- customType: regex
36+
fileMatch:
37+
- ^Dockerfile$
38+
matchStrings:
39+
- '#\s+renovate:\s+datasource=(?<datasource>.*?)\s+depName=(?<depName>.*?)(?:\s+versioning=(?<versioning>.*?))?(?:\s+extractVersion=(?<extractVersion>.*?))?\sARG\s+.*?_VERSION=(?<currentValue>.*)'
40+
versioningTemplate: "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"
41+
- customType: regex
42+
fileMatch:
43+
- ^hack/scripts/setup-
44+
matchStrings:
45+
- '#\s+renovate:\s+datasource=(?<datasource>.*?)\s+depName=(?<depName>.*?)(?:\s+versioning=(?<versioning>.*?))?(?:\s+extractVersion=(?<extractVersion>.*?))?\sBUILDKIT_IMAGE=\".+:(?<currentValue>.*)\"'
46+
versioningTemplate: "{{#if versioning}}{{versioning}}{{else}}semver{{/if}}"

‎Dockerfile‎

Lines changed: 174 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
1-
ARG DOCKER=docker:27.3.1-dind
1+
ARG DOCKER=docker:27.5.1-dind
22

33
FROM $DOCKER AS docker
44

5-
FROM alpine:3.20.3 AS build-container-drone
5+
FROM alpine:3.21.3 AS build-container-drone
66

77
# renovate: datasource=github-releases depName=docker/buildx
8-
ARG BUILDX_VERSION=v0.18.0
8+
ARG BUILDX_VERSION=v0.20.1
99
# renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=hashicorp/terraform
1010
ARG TERRAFORM_VERSION=1.7.3
1111

@@ -75,40 +75,184 @@ ADD hack/scripts/ /usr/local/bin/
7575

7676
COPY --from=docker /usr/local/bin/docker /usr/local/bin/dockerd /usr/local/bin/
7777

78-
FROM ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-dind:ubuntu-22.04 AS build-container-ghaction
78+
# renovate: datasource=github-releases extractVersion=^gha-runner-scale-set-(?<version>.*)$ depName=actions/actions-runner-controller
79+
ARG ACTIONS_RUNNER_CONTROLLER_VERSION=0.10.1
80+
FROM scratch AS actions-runner-controller-source
81+
ADD https://github.com/actions/actions-runner-controller.git#${ACTIONS_RUNNER_CONTROLLER_VERSION}:runner /
82+
83+
# Ref: https://github.com/actions/actions-runner-controller/blob/master/runner/actions-runner-dind.ubuntu-22.04.dockerfile
84+
FROM ubuntu:25.04 AS build-container-ghaction
85+
86+
ARG TARGETPLATFORM
87+
# renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=actions/runner
88+
ARG RUNNER_VERSION=2.322.0
89+
# renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=actions/runner-container-hooks
90+
ARG RUNNER_CONTAINER_HOOKS_VERSION=0.6.2
91+
# Docker and Docker Compose arguments
92+
ARG CHANNEL=stable
93+
# renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=moby/moby
94+
ARG DOCKER_VERSION=27.5.1
95+
# renovate: datasource=github-releases depName=docker/compose
96+
ARG DOCKER_COMPOSE_VERSION=v2.33.0
97+
# renovate: datasource=github-releases extractVersion=^v(?<version>.*)$ depName=yelp/dumb-init
98+
ARG DUMB_INIT_VERSION=1.2.5
99+
ARG RUNNER_USER_UID=1001
100+
ARG DOCKER_GROUP_GID=121
101+
79102
# renovate: datasource=github-releases depName=google/go-containerregistry
80-
ARG CRANE_VERSION=v0.20.2
103+
ARG CRANE_VERSION=v0.20.3
81104
# renovate: datasource=github-releases depName=mikefarah/yq
82-
ARG YQ_VERSION=v4.44.3
105+
ARG YQ_VERSION=v4.45.1
83106
# renovate: datasource=github-releases depName=getsops/sops
84-
ARG SOPS_VERSION=v3.9.1
107+
ARG SOPS_VERSION=v3.9.4
85108
# renovate: datasource=github-tags depName=aws/aws-cli
86-
ARG AWSCLI_VERSION=2.19.1
87-
USER root
88-
RUN apt update && \
89-
apt upgrade -y && \
90-
apt install -y \
91-
--no-install-recommends \
92-
curl \
93-
diffoscope \
94-
docker.io \
95-
gh \
96-
iproute2 \
97-
iptables \
98-
make \
99-
mkisofs \
100-
openssh-client \
101-
ovmf \
102-
qemu-system \
103-
qemu-utils \
104-
socat \
105-
swtpm \
106-
tmux \
107-
unzip \
108-
zstd
109+
ARG AWSCLI_VERSION=2.24.5
110+
111+
ENV DEBIAN_FRONTEND=noninteractive
112+
RUN apt-get update -y \
113+
&& apt-get install -y software-properties-common \
114+
&& add-apt-repository -y ppa:git-core/ppa \
115+
&& apt-get update -y \
116+
&& apt-get install -y --no-install-recommends \
117+
curl \
118+
ca-certificates \
119+
git \
120+
iptables \
121+
jq \
122+
software-properties-common \
123+
sudo \
124+
unzip \
125+
zip \
126+
&& rm -rf /var/lib/apt/lists/*
127+
128+
RUN apt-get update -y && \
129+
apt upgrade -y && \
130+
apt install -y \
131+
--no-install-recommends \
132+
curl \
133+
diffoscope \
134+
gh \
135+
iproute2 \
136+
iptables \
137+
make \
138+
mkisofs \
139+
openssh-client \
140+
ovmf \
141+
qemu-system \
142+
qemu-utils \
143+
socat \
144+
swtpm \
145+
tmux \
146+
unzip \
147+
zstd \
148+
libicu76 \
149+
net-tools \
150+
&& rm -rf /var/lib/apt/lists/*
109151

110152
RUN curl -fSL https://github.com/mikefarah/yq/releases/download/${YQ_VERSION}/yq_linux_amd64 -o /usr/bin/yq && chmod +x /usr/bin/yq
111153
RUN curl -fSL https://github.com/google/go-containerregistry/releases/download/${CRANE_VERSION}/go-containerregistry_Linux_x86_64.tar.gz | tar xzf - -C /usr/local/bin/ crane
112154
RUN curl -fSL https://github.com/getsops/sops/releases/download/${SOPS_VERSION}/sops-${SOPS_VERSION}.linux.amd64 -o /usr/bin/sops && chmod +x /usr/bin/sops
113155
RUN curl -fSL https://awscli.amazonaws.com/awscli-exe-linux-x86_64-${AWSCLI_VERSION}.zip -o awscliv2.zip && unzip awscliv2.zip && ./aws/install && rm -rf awscliv2.zip aws
156+
157+
# Runner user
158+
RUN adduser --disabled-password --gecos "" --uid $RUNNER_USER_UID runner \
159+
&& groupadd docker --gid $DOCKER_GROUP_GID \
160+
&& usermod -aG sudo runner \
161+
&& usermod -aG docker runner \
162+
&& echo "%sudo ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \
163+
&& echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers
164+
165+
ENV HOME=/home/runner
166+
167+
RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
168+
&& if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \
169+
&& if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \
170+
&& curl -fLo /usr/bin/dumb-init https://github.com/Yelp/dumb-init/releases/download/v${DUMB_INIT_VERSION}/dumb-init_${DUMB_INIT_VERSION}_${ARCH} \
171+
&& chmod +x /usr/bin/dumb-init
172+
173+
# installdependencies.sh is not updated for Ubuntu 25.04, so we add libicu76 manually above.
174+
ENV RUNNER_ASSETS_DIR=/runnertmp
175+
RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
176+
&& if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "x86_64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x64 ; fi \
177+
&& mkdir -p "$RUNNER_ASSETS_DIR" \
178+
&& cd "$RUNNER_ASSETS_DIR" \
179+
&& curl -fLo runner.tar.gz https://github.com/actions/runner/releases/download/v${RUNNER_VERSION}/actions-runner-linux-${ARCH}-${RUNNER_VERSION}.tar.gz \
180+
&& tar xzf ./runner.tar.gz \
181+
&& rm -f runner.tar.gz \
182+
&& ./bin/installdependencies.sh \
183+
# libyaml-dev is required for ruby/setup-ruby action.
184+
# It is installed after installdependencies.sh and before removing /var/lib/apt/lists
185+
# to avoid rerunning apt-update on its own.
186+
&& apt-get install -y libyaml-dev \
187+
&& rm -rf /var/lib/apt/lists/*
188+
189+
ENV RUNNER_TOOL_CACHE=/opt/hostedtoolcache
190+
RUN mkdir /opt/hostedtoolcache \
191+
&& chgrp docker /opt/hostedtoolcache \
192+
&& chmod g+rwx /opt/hostedtoolcache
193+
194+
RUN cd "$RUNNER_ASSETS_DIR" \
195+
&& curl -fLo runner-container-hooks.zip https://github.com/actions/runner-container-hooks/releases/download/v${RUNNER_CONTAINER_HOOKS_VERSION}/actions-runner-hooks-k8s-${RUNNER_CONTAINER_HOOKS_VERSION}.zip \
196+
&& unzip ./runner-container-hooks.zip -d ./k8s \
197+
&& rm -f runner-container-hooks.zip
198+
199+
RUN set -vx; \
200+
export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
201+
&& if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \
202+
&& if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \
203+
&& curl -fLo docker.tgz https://download.docker.com/linux/static/${CHANNEL}/${ARCH}/docker-${DOCKER_VERSION}.tgz \
204+
&& tar zxvf docker.tgz \
205+
&& install -o root -g root -m 755 docker/* /usr/bin/ \
206+
&& rm -rf docker docker.tgz
207+
208+
RUN export ARCH=$(echo ${TARGETPLATFORM} | cut -d / -f2) \
209+
&& if [ "$ARCH" = "arm64" ]; then export ARCH=aarch64 ; fi \
210+
&& if [ "$ARCH" = "amd64" ] || [ "$ARCH" = "i386" ]; then export ARCH=x86_64 ; fi \
211+
&& mkdir -p /usr/libexec/docker/cli-plugins \
212+
&& curl -fLo /usr/libexec/docker/cli-plugins/docker-compose https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-linux-${ARCH} \
213+
&& chmod +x /usr/libexec/docker/cli-plugins/docker-compose \
214+
&& ln -s /usr/libexec/docker/cli-plugins/docker-compose /usr/bin/docker-compose \
215+
&& which docker-compose \
216+
&& docker compose version
217+
218+
# We place the scripts in `/usr/bin` so that users who extend this image can
219+
# override them with scripts of the same name placed in `/usr/local/bin`.
220+
ARG RUNNER_CONTROLLER_SCRIPT_DIR_URL=https://raw.githubusercontent.com/actions/actions-runner-controller/refs/tags/gha-runner-scale-set-0.10.1/runner
221+
ADD ${RUNNER_CONTROLLER_SCRIPT_DIR_URL}/entrypoint-dind.sh \
222+
${RUNNER_CONTROLLER_SCRIPT_DIR_URL}/startup.sh \
223+
${RUNNER_CONTROLLER_SCRIPT_DIR_URL}/logger.sh \
224+
${RUNNER_CONTROLLER_SCRIPT_DIR_URL}/wait.sh \
225+
${RUNNER_CONTROLLER_SCRIPT_DIR_URL}/graceful-stop.sh \
226+
${RUNNER_CONTROLLER_SCRIPT_DIR_URL}/update-status \
227+
/usr/bin/
228+
COPY --from=actions-runner-controller-source \
229+
/entrypoint-dind.sh \
230+
/startup.sh \
231+
/logger.sh \
232+
/wait.sh \
233+
/graceful-stop.sh \
234+
/update-status \
235+
/usr/bin/
236+
RUN chmod +x /usr/bin/entrypoint-dind.sh /usr/bin/startup.sh
237+
238+
# Copy the docker shim which propagates the docker MTU to underlying networks
239+
# to replace the docker binary in the PATH.
240+
COPY --from=actions-runner-controller-source /docker-shim.sh /usr/local/bin/docker
241+
242+
# Configure hooks folder structure.
243+
COPY --from=actions-runner-controller-source /hooks /etc/arc/hooks/
244+
245+
VOLUME /var/lib/docker
246+
247+
# Add the Python "User Script Directory" to the PATH
248+
ENV PATH="${PATH}:${HOME}/.local/bin"
249+
ENV ImageOS=ubuntu25
250+
251+
RUN echo "PATH=${PATH}" > /etc/environment \
252+
&& echo "ImageOS=${ImageOS}" >> /etc/environment
253+
254+
# No group definition, as that makes it harder to run docker.
114255
USER runner
256+
257+
ENTRYPOINT ["/bin/bash", "-c"]
258+
CMD ["entrypoint-dind.sh"]

‎Makefile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ docker-%: ## Builds the specified target defined in the Pkgfile using the docke
3232
.PHONY: build-container
3333
build-container:
3434
@$(MAKE) docker-build-container-drone TARGET_ARGS="--push=$(PUSH)"
35-
@$(MAKE) docker-build-container-ghaction TARGET_ARGS="--push=$(PUSH)" TAG="actions-runner-ubuntu-22.04"
35+
@$(MAKE) docker-build-container-ghaction TARGET_ARGS="--push=$(PUSH)" TAG="actions-runner-ubuntu-dind-25.04"
3636

3737
.PHONY: rekres
3838
rekres:

‎hack/scripts/setup-ci‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5,7 +5,7 @@ set -ex
55
export TAG=$(git log --oneline --format=%B -n 1 HEAD | head -n 1 | sed -r "/^release\(/ s/^release\((.*)\):.*$/\\1/; t; Q")
66

77
# renovate: datasource=github-releases depName=moby/buildkit
8-
BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.17.0"
8+
BUILDKIT_IMAGE="docker.io/moby/buildkit:v0.19.0"
99

1010
# setup buildkit across amd64/arm64 workers
1111
function setup_buildkit() {

0 commit comments

Comments
 (0)