continuist
f3f80f2679
Some checks failed
CI/CD Pipeline with Secure Ephemeral PiP / test-backend (push) Failing after 32s
CI/CD Pipeline with Secure Ephemeral PiP / test-frontend (push) Has been skipped
CI/CD Pipeline with Secure Ephemeral PiP / build-backend (push) Has been skipped
CI/CD Pipeline with Secure Ephemeral PiP / build-frontend (push) Has been skipped
CI/CD Pipeline with Secure Ephemeral PiP / deploy-prod (push) Has been skipped
52 lines
1.7 KiB
Bash
Executable file
52 lines
1.7 KiB
Bash
Executable file
#!/usr/bin/env bash
|
||
set -Eeuo pipefail
|
||
|
||
RUN_ID="${RUN_ID:-${GITHUB_RUN_ID:-local}}"
|
||
PIP_CONTAINER_NAME="ci-pip-${RUN_ID}"
|
||
RUNTIME_DIR="${XDG_RUNTIME_DIR:-/run/user/$(id -u)}"
|
||
SOCKET_PATH="${RUNTIME_DIR}/podman/podman.sock" # <- only standard rootless socket
|
||
WORKSPACE="${GITHUB_WORKSPACE:-$PWD}"
|
||
|
||
# Required: pinned client image digest
|
||
PODMAN_CLIENT_IMG_DIGEST="${PODMAN_CLIENT_IMG_DIGEST:-}"
|
||
[[ -n "$PODMAN_CLIENT_IMG_DIGEST" ]] || { echo "ERROR: PODMAN_CLIENT_IMG_DIGEST is required"; exit 1; }
|
||
|
||
# Check the socket
|
||
[[ -S "$SOCKET_PATH" ]] || {
|
||
echo "ERROR: Podman UNIX socket not found at $SOCKET_PATH"
|
||
echo "Fix: sudo -iu ci-service systemctl --user enable --now podman.socket"
|
||
exit 1
|
||
}
|
||
|
||
# Match the socket owner uid:gid (don’t use 0:0)
|
||
read -r SOCK_UID SOCK_GID < <(stat -c '%u %g' "$SOCKET_PATH")
|
||
PUID="${PIP_UID:-$SOCK_UID}"
|
||
PGID="${PIP_GID:-$SOCK_GID}"
|
||
|
||
# Clean previous container
|
||
podman rm -f "${PIP_CONTAINER_NAME}" >/dev/null 2>&1 || true
|
||
|
||
# Start the PiP client: no net, no caps, read-only FS; mount socket dir at same path
|
||
podman run -d \
|
||
--name "${PIP_CONTAINER_NAME}" \
|
||
--user "${PUID}:${PGID}" \
|
||
-e HOME=/tmp \
|
||
--security-opt=no-new-privileges \
|
||
--cap-drop=ALL \
|
||
--read-only \
|
||
--network=none \
|
||
--tmpfs /run:rw,size=64M \
|
||
--tmpfs /tmp:rw,size=256M \
|
||
-v "${RUNTIME_DIR}/podman:${RUNTIME_DIR}/podman:rw" \
|
||
-v "${WORKSPACE}:/workspace:rw" \
|
||
-e CONTAINER_HOST="unix://${SOCKET_PATH}" \
|
||
"${PODMAN_CLIENT_IMG_DIGEST}" \
|
||
sleep infinity
|
||
|
||
# Health check
|
||
sleep 3
|
||
podman inspect "${PIP_CONTAINER_NAME}" --format '{{.State.Status}}' | grep -q running \
|
||
|| { echo "ERROR: PiP container failed to start"; podman logs "${PIP_CONTAINER_NAME}" || true; exit 1; }
|
||
|
||
echo "PiP container ready: ${PIP_CONTAINER_NAME}"
|
||
echo "Using socket: ${SOCKET_PATH}"
|