gofix/portal-tunnel-rs
Watch
1
0
Fork
You've already forked portal-tunnel-rs
 0
Code Issues Pull requests Projects Releases 22 Packages 1 Wiki Activity Actions

ci: drop sudo from rust-host Windows cross-check #118

Merged
ada merged 1 commit from ci/unprivileged-rust-host into master 2026-10-27 16:19:34 +00:00
Conversation 0 Commits 1 Files changed 1 +6 -2
ada commented 2026-10-27 16:03:36 +00:00
Collaborator

Problem

The rust-host runner executed jobs as inseo on uvm. That account has NOPASSWD sudo and is in the docker group, so any approved PR job could gain host root.

Change (infra, already applied)

  • The rust-host runner now runs as the dedicated unprivileged user forgejo-ci. The user has no sudo and no docker group membership.
  • Docker access is through rootless Docker owned by that user.
  • An nftables egress policy blocks the host's loopback services, the LAN, the tailnet and the Docker bridges. Allowed traffic: Forgejo, DNS, the internet, and the job's own ephemeral ports.

Change (this PR)

sudo apt-get install gcc-mingw-w64-x86-64 cannot run without sudo. The linker is now provisioned on the host, and the step only checks that it is present.

Validation

The CI on this PR is the end-to-end test of the new runner.

## Problem The `rust-host` runner executed jobs as `inseo` on uvm. That account has NOPASSWD sudo and is in the docker group, so any approved PR job could gain host root. ## Change (infra, already applied) - The `rust-host` runner now runs as the dedicated unprivileged user `forgejo-ci`. The user has no sudo and no docker group membership. - Docker access is through rootless Docker owned by that user. - An nftables egress policy blocks the host's loopback services, the LAN, the tailnet and the Docker bridges. Allowed traffic: Forgejo, DNS, the internet, and the job's own ephemeral ports. ## Change (this PR) `sudo apt-get install gcc-mingw-w64-x86-64` cannot run without sudo. The linker is now provisioned on the host, and the step only checks that it is present. ## Validation The CI on this PR is the end-to-end test of the new runner.
ci: drop sudo from rust-host Windows cross-check
All checks were successful
Rust CI / Format, lint, and test (pull_request) Successful in 4m3s
Details
Rust CI / Build and start linux/arm64 image (no push) (pull_request) Successful in 10s
Details
3a539d0783 
The rust-host runner now runs as an unprivileged user without sudo.
The MinGW cross linker is provisioned on the runner host instead, so
the step only verifies that it is present.
ada merged commit db4e25e69d into master 2026-10-27 16:19:34 +00:00
ada deleted branch ci/unprivileged-rust-host 2026-10-27 16:19:34 +00:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
gofix/portal-tunnel-rs!118
No description provided.