Skip to content

fix(image): run the GARM agent in a PAM login session #245

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
cbartz merged 3 commits into from
Oct 9, 2026
Merged

fix(image): run the GARM agent in a PAM login session #245

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1d07a94
fix(image): set XDG_RUNTIME_DIR for the GARM agent
cbartz Oct 8, 2026
e10355e
docs: add changelog entry for the XDG_RUNTIME_DIR fix
cbartz Oct 8, 2026
bad4c02
fix(image): run the GARM agent in a PAM login session
cbartz Oct 8, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion app/pyproject.toml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,7 +3,7 @@

[project]
name = "github-runner-image-builder"
version = "0.14.2"
version = "0.14.3"
authors = [
{ name = "Canonical IS DevOps", email = "is-devops-team@canonical.com" },
]
Expand Down
9 changes: 9 additions & 0 deletions app/src/github_runner_image_builder/templates/cloud-init.sh.j2
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,6 +195,15 @@ function configure_system_users() {
# removes /run/user/<uid> once the last session ends. A runner started as a system service
# has no login session, so linger is what keeps both alive.
/usr/bin/loginctl enable-linger ubuntu
# The GARM agent runs the runner from that system service, so jobs lack what a login session
# provides (XDG_RUNTIME_DIR, the user D-Bus bus) and tools like skopeo and podman fall back to
# the root-owned /run/containers. A PAM session restores it, as `su -` did for the previous
# runner manager; systemd applies the drop-in once GARM installs garm-agent.service.
/usr/bin/mkdir -p /etc/systemd/system/garm-agent.service.d
/usr/bin/cat > /etc/systemd/system/garm-agent.service.d/login-session.conf <<EOF
[Service]
PAMName=su-l
EOF

# Create runner user as alias to ubuntu for GARM compatibility.
# GARM expects a runner user with /home/runner/actions-runner path.
Expand Down
4 changes: 4 additions & 0 deletions app/tests/integration/commands.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -31,6 +31,10 @@ class Commands:
TEST_RUNNER_COMMANDS = (
Commands(name="simple hello world", command="echo hello world"),
Commands(name="print groups", command="groups | grep sudo"),
Commands(
name="check garm-agent login session drop-in",
command="grep -x PAMName=su-l /etc/systemd/system/garm-agent.service.d/login-session.conf",
),
Commands(name="file permission to /usr/local/bin", command="ls -ld /usr/local/bin"),
Commands(
name="file permission to /usr/local/bin (create)", command="touch /usr/local/bin/test_file"
Expand Down
9 changes: 9 additions & 0 deletions app/tests/unit/test_openstack_builder.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -929,6 +929,15 @@ def test__generate_cloud_init_script(
# removes /run/user/<uid> once the last session ends. A runner started as a system service
# has no login session, so linger is what keeps both alive.
/usr/bin/loginctl enable-linger ubuntu
# The GARM agent runs the runner from that system service, so jobs lack what a login session
# provides (XDG_RUNTIME_DIR, the user D-Bus bus) and tools like skopeo and podman fall back to
# the root-owned /run/containers. A PAM session restores it, as `su -` did for the previous
# runner manager; systemd applies the drop-in once GARM installs garm-agent.service.
/usr/bin/mkdir -p /etc/systemd/system/garm-agent.service.d
/usr/bin/cat > /etc/systemd/system/garm-agent.service.d/login-session.conf <<EOF
[Service]
PAMName=su-l
EOF

# Create runner user as alias to ubuntu for GARM compatibility.
# GARM expects a runner user with /home/runner/actions-runner path.
Expand Down
4 changes: 4 additions & 0 deletions docs/changelog.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,9 @@
<!-- vale Canonical.007-Headings-sentence-case = NO -->

## [#245 Run the GARM agent in a login session](https://github.com/canonical/github-runner-image-builder-operator/pull/245) (2026-10-08)

- Run the runner started by the GARM agent in a PAM login session, as the previous runner manager did with `su -`. The agent runs as a system service, so jobs had no `XDG_RUNTIME_DIR` or user D-Bus bus, and tools that keep per-user state there, such as `skopeo login`, `podman` and `buildah`, failed with `mkdir /run/containers: permission denied`.

Check warning on line 5 in docs/changelog.md

View workflow job for this annotation

GitHub Actions / docs-checks / vale 

[vale] reported by reviewdog 🐶
[Canonical.500-Repeated-words] 'bus' is repeated!

Raw Output:
{"message":"[Canonical.500-Repeated-words] 'bus' is repeated!","location":{"path":"docs/changelog.md","range":{"start":{"line":5,"column":195},"end":{"line":5,"column":202}}},"severity":"WARNING","code":{"value":"Canonical.500-Repeated-words"}}

## [#244](https://github.com/canonical/github-runner-image-builder-operator/pull/244) (2026-09-23)

- Ensure the `runner` group alongside the `runner` user.
Expand Down
Loading