Skip to content

fix(dockerfile): set more lenient permissions on /home/runner #4083

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 1 commit into from
Nov 10, 2025
Merged

fix(dockerfile): set more lenient permissions on /home/runner #4083

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 4 additions & 3 deletions images/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,14 +54,15 @@ RUN add-apt-repository ppa:git-core/ppa \
&& apt install -y git \
&& rm -rf /var/lib/apt/lists/*

WORKDIR /home/runner

RUN adduser --disabled-password --gecos "" --uid 1001 runner \
&& groupadd docker --gid 123 \
&& usermod -aG sudo runner \
&& usermod -aG docker runner \
&& echo "%sudo ALL=(ALL:ALL) NOPASSWD:ALL" > /etc/sudoers \
&& echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers

WORKDIR /home/runner
&& echo "Defaults env_keep += \"DEBIAN_FRONTEND\"" >> /etc/sudoers \
&& chmod 777 /home/runner
Copy link

@anuragstar anuragstar Nov 21, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@TingluoHuang @nikola-jokic This is a breaking change after upgrading the GitHub runner from 2.329.0 to 2.330.0. We are now seeing the error “failed to initialize build cache.” We need to revert back to 2.329.0. Could you please fix this so we don’t need separate handling on our side?.

failed to initialize build cache at /home/runner/.cache/go-build: mkdir /home/runner/.cache/go-build: permission denied
Error: Command failed: /opt/hostedtoolcache/go/1.25.1/x64/bin/go env
failed to initialize build cache at /home/runner/.cache/go-build: mkdir /home/runner/.cache/go-build: permission denied

Copy link
Contributor

@diogotorres97 diogotorres97 Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more. 

  ➤ YN0001: │ foobar@https://github.com/foo.git#commit=9434354e7bf8f19d229fecabbef9dedc678f5c47: Failed cloning the repository
  ➤ YN0001: │   Repository URL: https://github.com/foo.git
  ➤ YN0001: │   Error: invalid key:  core.autocrlf
  ➤ YN0001: │   Fatal Error: unable to write parameters to config file
  ➤ YN0001: │   Exit Code: 128

issues cloning private repositories

Copy link
Contributor Author

@caxu-rh caxu-rh Nov 21, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@nikola-jokic - one difference I'm seeing is in the owner uid/gid of the /home/runner directory.

  • In 2.329.0: Access: (0750/drwxr-x---) Uid: ( 1001/ runner) Gid: ( 1001/ runner)
  • In 2.330.0: Access: (0777/drwxrwxrwx) Uid: ( 0/ root) Gid: ( 0/ root)

I think the ownership change is due to moving WORKDIR above. I don't quite understand how this ownership change is causing the observed behavior, though.


COPY --chown=runner:docker --from=build /actions-runner .
COPY --from=build /usr/local/lib/docker/cli-plugins/docker-buildx /usr/local/lib/docker/cli-plugins/docker-buildx
Expand Down