Reduce Forgejo runner privileges and allowed volumes #7

New issue

Open

opened 2026-08-23 17:07:48 +00:00 by stanta · 0 comments

stanta commented

2026-08-23 17:07:48 +00:00

Owner

Outcome

Reduce runner privileges without breaking trusted build and deployment workflows.

Current state

The global runner LXC is privileged. Runner jobs can require Docker access, but the allowed host surface needs a focused review.

Work

Inventory workflows and required mounts.
Remove unused valid volumes and capabilities.
Separate build-only and deployment authority where practical.
Document remaining privilege requirements.
Test representative workflows.

Validation

Required workflows pass.
Unapproved host paths cannot be mounted.
Remaining privileges have concrete reasons.

References

iac/guides/roadmap-phase-2.md
iac/ansible/roles/forgejo_runner/
.forgejo/workflows/

## Outcome Reduce runner privileges without breaking trusted build and deployment workflows. ## Current state The global runner LXC is privileged. Runner jobs can require Docker access, but the allowed host surface needs a focused review. ## Work - [ ] Inventory workflows and required mounts. - [ ] Remove unused valid volumes and capabilities. - [ ] Separate build-only and deployment authority where practical. - [ ] Document remaining privilege requirements. - [ ] Test representative workflows. ## Validation - [ ] Required workflows pass. - [ ] Unapproved host paths cannot be mounted. - [ ] Remaining privileges have concrete reasons. ## References - `iac/guides/roadmap-phase-2.md` - `iac/ansible/roles/forgejo_runner/` - `.forgejo/workflows/`

stanta added the

labels

2026-08-23 17:07:48 +00:00