Skip to content

Conversation

@sweco-semhul
Copy link

Adding support for Docker Swarm secrets as option for sensitive variables.

And as a better solution for this issue, when running in a Docker Swarm environment, #278

export RUNNER_ALLOW_RUNASROOT=1
export PATH=${PATH}:/actions-runner

# Function to read secrets from file in a Docker Swarm setup
Copy link
Owner

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Im ok with this if its in a new file secrets.sh

#!/usr/bin/env bash
set -euo pipefail

SECRETS_DIR="/run/secrets"

for secret_file in "$SECRETS_DIR"/*; do
  # Skip if no files matched
  [[ -e "$secret_file" ]] || continue

  secret_name=$(basename "$secret_file")
  env_var_name=$(echo "$secret_name" | tr '[:lower:]' '[:upper:]' | tr '-' '_')

  # Read the secret
  secret_value=$(cat "$secret_file")

  # Export it
  export "$env_var_name=$secret_value"

  echo "Loaded secret: $env_var_name"
done

echo "Docker Swarm secrets loaded."

Then in entrypoint.sh at the top: _DOCKER_SWARM_SECRETS_ENABLED=${DOCKER_SWARM_SECRETS_ENABLED:-false}

and somewhere furhter below:

if [[ "${_DOCKER_SWARM_SECRETS_ENABLED}" == "true" ]]; then
  echo "Docker Swarm secrets enabled — loading secrets..."
  /secrets.sh
fi

also dont forget to modify https://github.com/myoung34/docker-github-actions-runner/blob/master/Dockerfile#L22-L23 to add script.sh with +x but also mkdir -p /run/secrets as well somewhere

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants