CI runner images
- Nix 56.7%
- Just 39.8%
- Shell 3.5%
Simon Shine
b3599f5546
Jobs run as root, which suits nix: the store is inside the container and only root can write it. Postgres disagrees -- initdb refuses to run as root outright, with no override -- so external-dns-pgregistry's integration tests have never passed in CI. image: - A runner user at uid 1000, in /etc/passwd because initdb resolves its own uid through getpwuid and fails on one that is not there. - /tmp at 1777 and /home/runner writable: store paths are read-only, so these are the only places an unprivileged step can put a cluster or a build cache. - as-runner wraps setpriv, so a workflow step reads as-runner just test-integration rather than spelling out the uid, the gid and HOME each time. - Deliberately not an image-wide USER, which would take nix's store writes with it, and util-linux stays off PATH, where it would take kill and more from coreutils. justfile: - test-image asserts all of the above by reading the layer, since the nixos runner has no docker daemon to run a container with. Each assertion was checked against a deliberately broken image. |
||
|---|---|---|
| .forgejo | ||
| nix | ||
| .envrc | ||
| .gitignore | ||
| flake.lock | ||
| flake.nix | ||
| justfile | ||