Repository navigation
Conversation
GARM's agent mode starts the runner from a system service without a login session, so jobs have no XDG_RUNTIME_DIR and skopeo/podman/buildah fall back to the root-owned /run/containers. Enable lingering for the runner user and export XDG_RUNTIME_DIR via the runner .env from the shared charmed template.
|
|
||
| decoded = result.decode() | ||
| assert decoded.startswith("#!/bin/bash\n") | ||
| assert "sudo loginctl enable-linger runner" in decoded |
There was a problem hiding this comment.
runner or ubuntu?
There was a problem hiding this comment.
🟡 Changes recommended
Provisioning should fail visibly or verify the runtime directory when setup commands fail.
1 open finding
What changed in this PR
Updates GARM runner templates to configure lingering and XDG_RUNTIME_DIR for agent-mode jobs.
Changes:
- Adds runtime-directory setup to the shared runner template.
- Adds unit coverage for the generated snippet.
- Documents the fix in the changelog.
| File | Summary |
|---|---|
docs/changelog.md |
Documents the runner environment fix. |
charms/garm/tests/unit/test_garm_template.py |
Tests the injected template commands. |
charms/garm/src/garm_template.py |
Configures lingering and XDG_RUNTIME_DIR; setup failures are currently swallowed. |
🧠 Review effort: Lite
Give feedback about Copilot approvals in this survey to enter a drawing for a $150 gift card.
| # podman, buildah) fall back to root-owned /run/containers. Lingering keeps | ||
| # /run/user/<uid> alive without a session; the .env entry exports it to every job. | ||
| _RUNNER_RUNTIME_DIR_SNIPPET: typing.Final[str] = f"""\ | ||
| sudo loginctl enable-linger {RUNNER_USER} || true |
|
Closing in favour of canonical/github-runner-image-builder-operator#245. The image already enables linger for the runner user ( AI-generated message. |
What this PR does
Always prepends a snippet to the shared
github_linux_charmedrunner template that enables lingering for the runner user and appendsXDG_RUNTIME_DIR=/run/user/<uid>to the runner.env. Per-scaleset templates derive from this template, so every scaleset gets it.Why we need it
In agent mode, GARM starts the runner from a system service without a login session, so jobs have no
XDG_RUNTIME_DIR. Tools that keep per-user state there (skopeo login,podman,buildah) then fall back to/run/containers/<uid>and fail withmkdir /run/containers: permission denied. The previous runner manager started the runner viasu -, which created a session.Test plan
XDG_RUNTIME_DIRandskopeo loginsucceeds.Review focus
actions-runner/.envin agent mode (same mechanism the job-start hook uses) and on passwordlesssudofor the runner user at install time.Checklist
CONTRIBUTING.mdhas been updated upon changes to the contribution/development process (e.g. changes to the way tests are run) — N/A, no process changedocs/changelog.mdwith user-relevant changesterraform fmtpasses andtflintreports no errors — N/AAGENTS.md— N/A.copilot-collections.yamlor.github/instructions/: I re-checked theAGENTS.md"12-factor divergences" guidance — N/A