From 706461b845086ee2df8ce9acae3dae7feebfffda Mon Sep 17 00:00:00 2001 From: tegwick Date: Tue, 13 Oct 2026 18:41:10 +0200 Subject: [PATCH] security: restrict runner Docker API to pod loopback Assistant: codex Assistant-Model: gpt-6-astra Assistant-Session: 01a1346b-72a4-7d40-b8bd-8b8ca346cfa2 --- manifests/forgejo-runner.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/manifests/forgejo-runner.yaml b/manifests/forgejo-runner.yaml index 3db38ea..ccbb94b 100644 --- a/manifests/forgejo-runner.yaml +++ b/manifests/forgejo-runner.yaml @@ -65,7 +65,7 @@ spec: fsGroup: 1000 initContainers: - name: register - image: code.forgejo.org/forgejo/runner:6.3.1 + image: code.forgejo.org/forgejo/runner@sha256:5071e6832313bafe71577e05631bece88caff08fcfb372193e4a21941f4ed54b imagePullPolicy: IfNotPresent command: ["/bin/sh", "/scripts/register.sh"] env: @@ -88,7 +88,7 @@ spec: readOnly: true containers: - name: dind - image: docker:27-dind + image: docker.io/library/docker@sha256:aa3df78ecf320f5fafdce71c659f1629e96e9de0968305fe1de670e0ca9176ce imagePullPolicy: IfNotPresent securityContext: privileged: true @@ -98,15 +98,15 @@ spec: args: - dockerd - -H - - tcp://0.0.0.0:2375 + - tcp://127.0.0.1:2375 - --tls=false readinessProbe: - tcpSocket: - port: 2375 + exec: + command: ["sh", "-c", "wget -q -O- -T 3 http://127.0.0.1:2375/_ping | grep -qx OK"] initialDelaySeconds: 10 periodSeconds: 10 - name: runner - image: code.forgejo.org/forgejo/runner:6.3.1 + image: code.forgejo.org/forgejo/runner@sha256:5071e6832313bafe71577e05631bece88caff08fcfb372193e4a21941f4ed54b imagePullPolicy: IfNotPresent env: - name: DOCKER_HOST