0

I have the following problem on my CentOS VM.

In the VM I run the process gitlab-runner as root - see my systemd service.

root@runner1:~$ cat /etc/systemd/system/gitlab-runner.service | sed 's/^/    /'
[Unit]
Description=GitLab Runner
After=syslog.target network.target
ConditionFileIsExecutable=/usr/lib/gitlab-runner/gitlab-runner

[Service]
StartLimitInterval=5
StartLimitBurst=10
ExecStart=/usr/lib/gitlab-runner/gitlab-runner "run" "--working-directory" "/home/gitlab-runner/builds/" "--config" "/etc/gitlab-runner/config.toml" "--service" "gitlab-runner" "--syslog" "--user" "root"

Restart=always
RestartSec=120

[Install]
WantedBy=multi-user.target

Some builds require root permissions to create or delete files at certain locations. Now gitlab-runner always throws errors. The reason is that the process gitlab-runner, although started as root, does sub-processes running as user gitlab-runner. Here is a snippet of my pipeline logfile

$ id -u
997
$ whoami
gitlab-runner
$ rm -rf /tmp/*
rm: cannot remove ‘/tmp/ks-script-1yMUS_’: Operation not permitted
rm: cannot remove ‘/tmp/ks-script-jNgpQ5’: Operation not permitted
rm: cannot remove ‘/tmp/systemd-private-1838297d1ab047a99c3628869e77fd18-chronyd.service-z1RO0u’: Operation not permitted
rm: cannot remove ‘/tmp/tmp.THBemf0N5O’: Operation not permitted
rm: cannot remove ‘/tmp/yum.log’: Operation not permitted

How can I prevent gitlab-runner from starting sub-processes under another user?

Volker

0

I've found the solution, if gitlab-runner is executed as root, the workspace must not be located in another home directory.

I have now changed the system as follows:

[Unit]
Description=GitLab Runner
After=syslog.target network.target
ConditionFileIsExecutable=/usr/lib/gitlab-runner/gitlab-runner

[Service]
StartLimitInterval=5
StartLimitBurst=10
ExecStart=/usr/lib/gitlab-runner/gitlab-runner "run" "--working-directory" "/root/builds/" "--config" "/etc/gitlab-runner/config.toml" "--service" "gitlab-runner" "--syslog" "--user" "root"

Restart=always
RestartSec=120

[Install]
WantedBy=multi-user.target

Now the process finally runs as a real user. To the developers, it would be useful to give at least some information why the service does not run as root but as gitlab-runner.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.