Repository navigation
fix(image): run the GARM agent in a PAM login session - #245
Conversation
GARM's agent mode starts the runner from garm-agent.service, a system service without a login session, so jobs inherit no XDG_RUNTIME_DIR. Tools that keep per-user state there (skopeo, podman, buildah) then fall back to the root-owned /run/containers and fail. Add a systemd drop-in pointing it at /run/user/<uid>, which lingering already keeps alive.
There was a problem hiding this comment.
🟢 Approval recommended
The drop-in correctly complements user lingering, and the focused tests cover its generated and installed configuration.
0 open findings
What changed in this PR
Adds an image-level systemd drop-in so GARM runner jobs receive a valid XDG_RUNTIME_DIR.
Changes:
- Configures
XDG_RUNTIME_DIRusing the runner’s shared UID. - Adds unit and image integration coverage.
- Updates the changelog and package version.
| File | Description |
|---|---|
docs/changelog.md |
Documents the GARM runtime-directory fix. |
app/tests/unit/test_openstack_builder.py |
Updates generated cloud-init expectations. |
app/tests/integration/commands.py |
Verifies the drop-in on built images. |
app/src/github_runner_image_builder/templates/cloud-init.sh.j2 |
Creates the systemd environment drop-in. |
app/pyproject.toml |
Bumps the application version to 0.14.3. |
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
Setting XDG_RUNTIME_DIR alone restores one piece of what the previous runner manager's su - provided. A PAMName=su-l drop-in restores the session itself (XDG_RUNTIME_DIR, the user D-Bus bus, pam_env, pam_limits), without the TTY-oriented modules of the login stack.
cbartz
changed the title
There was a problem hiding this comment.
🟢 Approval recommended
The focused configuration change is consistent with GARM’s unit lifecycle and is covered by unit and integration checks.
0 open findings
🧠 Review effort: Balanced
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
yanksyoon
left a comment
yanksyoon
left a comment
There was a problem hiding this comment.
Do you think we should add this to the image building repository as well? Lgtm
yes we should as well |
Applicable spec: N/A
Overview
Adds a systemd drop-in that runs
garm-agent.servicein a PAM login session (PAMName=su-l), next to the existingloginctl enable-lingerthat keeps/run/user/<uid>alive.Rationale
In agent mode GARM starts the runner from
garm-agent.service, a system service withUser=runnerand no login session, so jobs inherit noXDG_RUNTIME_DIR. Tools that keep per-user state there then fall back to the root-owned/run/containers, e.g.skopeo loginfails withmkdir /run/containers: permission denied. The previous runner manager started the runner viasu -, which provided a session;PAMName=su-lrestores that session (XDG_RUNTIME_DIR,DBUS_SESSION_BUS_ADDRESS,pam_env,pam_limits) rather than a single variable.su-lrather thanloginavoids the TTY-oriented modules (pam_motdon every agent restart, the removedpam_lastlog). The drop-in can exist before the unit; systemd applies it once GARM's userdata installsgarm-agent.service. This targets GARM's agent mode, which the GARM charm enables; runners GARM starts in non-agent mode (viasvc.sh, asactions.runner.<…>.service) are not covered. Verified on Ubuntu 24.04 / systemd 255 with a unit shaped likegarm-agent: jobs seeXDG_RUNTIME_DIR=/run/user/1000, and restarts open a fresh session and close the old one.Supersedes canonical/github-runner-operators#415, which set
XDG_RUNTIME_DIRfrom the GARM charm instead: the session setup (linger) belongs together in the image.Juju Events Changes
None.
Module Changes
cloud-init.sh.j2(configure_system_users): write the drop-in. Unit test expectation and an integration check on the built image updated accordingly.Library Changes
None.
Checklist
urgent,trivial,senior-review-required,documentation)app/pyproject.tomlCharmhub documentation: no charm behaviour or configuration change. Label: to be set by the author (
urgent).