feat(github-runners): add ephemeral self-hosted runners on build servers (#12054)

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
2026-11-06 13:10:37 -04:00 · 2026-09-30 12:13:11 +02:00
parent 03a056709d
commit fd85b740f5
40 changed files with 3605 additions and 20 deletions
@@ -0,0 +1,121 @@
+<?php
+
+use App\Models\GithubRunnerConfig;
+use App\Models\GithubRunnerExecution;
+use App\Models\Server;
+use App\Services\GithubRunner\GithubRunnerContainer;
+use Tests\TestCase;
+
+uses(TestCase::class);
+
+beforeEach(function () {
+    $this->execution = (new GithubRunnerExecution)->forceFill(['uuid' => 'abc123']);
+    $this->config = (new GithubRunnerConfig)->forceFill([
+        'docker_mode' => 'dind',
+        'cpu_limit' => '2',
+        'memory_limit' => '4g',
+        'runner_image' => null,
+    ]);
+    $this->nonRootServer = Mockery::mock(Server::class)->makePartial();
+    $this->nonRootServer->shouldReceive('getAttribute')->with('user')->andReturn('ubuntu');
+});
+
+afterEach(function () {
+    Mockery::close();
+});
+
+it('starts a privileged Docker sidecar with limits on a private network', function () {
+    $commands = (new GithubRunnerContainer($this->execution, $this->config))->prepareCommands();
+
+    expect($commands[0])->toBe('docker network create --label coolify.githubRunner=true --label coolify.githubRunnerExecution=abc123 coolify-runner-abc123')
+        ->and($commands)->toContain('docker volume create --label coolify.githubRunner=true --label coolify.githubRunnerExecution=abc123 coolify-runner-abc123-work')
+        ->and(end($commands))
+        ->toStartWith('docker run -d --privileged --name coolify-runner-abc123-dind --network coolify-runner-abc123')
+        ->toContain("--pids-limit 4096 --cpus '2' --memory '4g' --memory-swap '4g'")
+        ->toContain('-v coolify-runner-abc123-sock:/var/run -v coolify-runner-abc123-work:/home/runner/_work')
+        ->toContain("'".config('constants.github_runner.dind_image')."' dockerd --host=unix:///var/run/docker.sock --group=123");
+});
+
+it('passes the JIT config through a root-only env file and never mounts the host Docker socket', function () {
+    $commands = (new GithubRunnerContainer($this->execution, $this->config))->startCommands('SECRET');
+    $all = implode("\n", $commands);
+
+    expect($all)->not->toContain('SECRET')
+        ->toContain(base64_encode("ACTIONS_RUNNER_INPUT_JITCONFIG=SECRET\n"))
+        ->not->toContain('docker.sock:/var/run/docker.sock')
+        ->and($commands[2])->toBe('chmod 600 /data/coolify/github-runners/abc123.env')
+        ->and($commands[4])
+        ->toStartWith('docker run -d --name coolify-runner-abc123 --network coolify-runner-abc123')
+        ->toContain('--env-file /data/coolify/github-runners/abc123.env -e DOCKER_HOST=unix:///var/run/docker.sock')
+        ->toEndWith("'".config('constants.github_runner.image')."' /home/runner/run.sh")
+        ->and(end($commands))->toBe('rm -f /data/coolify/github-runners/abc123.env');
+});
+
+it('starts the Docker sidecar with the Sysbox runtime instead of privileged mode', function () {
+    $this->config->forceFill(['docker_mode' => 'sysbox']);
+    $container = new GithubRunnerContainer($this->execution, $this->config);
+    $commands = [...$container->prepareCommands(), ...$container->startCommands('SECRET')];
+    $all = implode("\n", $commands);
+
+    expect($container->usesDind())->toBeTrue()
+        ->and($all)->not->toContain('--privileged')
+        ->toContain('docker run -d --runtime=sysbox-runc --name coolify-runner-abc123-dind --network coolify-runner-abc123')
+        ->toContain('-e DOCKER_HOST=unix:///var/run/docker.sock');
+});
+
+it('starts only an unprivileged runner when Docker is disabled', function () {
+    $this->config->forceFill(['docker_mode' => 'none', 'cpu_limit' => null, 'memory_limit' => null]);
+    $container = new GithubRunnerContainer($this->execution, $this->config);
+    $all = implode("\n", [...$container->prepareCommands(), ...$container->startCommands('SECRET')]);
+
+    expect($all)->not->toContain('--privileged')
+        ->not->toContain('DOCKER_HOST')
+        ->not->toContain('-dind')
+        ->not->toContain('--cpus');
+});
+
+it('uses the latest official runner image by default', function () {
+    expect(config('constants.github_runner.image'))->toBe('ghcr.io/actions/actions-runner:latest');
+});
+
+it('pulls the runner image every time so that a moving tag stays current', function () {
+    $commands = (new GithubRunnerContainer($this->execution, $this->config))->prepareCommands();
+    $image = "'".config('constants.github_runner.image')."'";
+    $dindImage = "'".config('constants.github_runner.dind_image')."'";
+
+    expect($commands)
+        // Falls back to the local image when the registry cannot be reached.
+        ->toContain("docker pull {$image} || docker image inspect {$image} > /dev/null")
+        ->toContain("docker image inspect {$dindImage} > /dev/null 2>&1 || docker pull {$dindImage}");
+});
+
+it('quotes a custom runner image', function () {
+    $this->config->forceFill(['runner_image' => 'ghcr.io/acme/runner:1.0']);
+    $commands = (new GithubRunnerContainer($this->execution, $this->config))->startCommands('SECRET');
+
+    expect($commands[4])->toEndWith("'ghcr.io/acme/runner:1.0' /home/runner/run.sh");
+});
+
+it('keeps every command valid for servers with a non-root user', function () {
+    $container = new GithubRunnerContainer($this->execution, $this->config);
+    $commands = collect([
+        ...$container->prepareCommands(),
+        $container->dockerReadyCommand(),
+        ...$container->startCommands('SECRET'),
+        ...GithubRunnerContainer::cleanupCommands('abc123'),
+        GithubRunnerContainer::listCommand(),
+    ]);
+
+    $parsed = parseCommandsByLineForSudo($commands, $this->nonRootServer);
+
+    expect($parsed)
+        ->toContain('sudo docker pull '."'".config('constants.github_runner.image')."'".' || sudo docker image inspect '."'".config('constants.github_runner.image')."'".' > /dev/null')
+        ->toContain('echo '.base64_encode("ACTIONS_RUNNER_INPUT_JITCONFIG=SECRET\n").' | sudo base64 -d | sudo tee /data/coolify/github-runners/abc123.env > /dev/null')
+        ->toContain('sudo chmod 600 /data/coolify/github-runners/abc123.env')
+        ->toContain('sudo docker rm -f -v coolify-runner-abc123 coolify-runner-abc123-dind > /dev/null 2>&1 || sudo true')
+        ->toContain("sudo docker exec coolify-runner-abc123-dind docker version --format '{{.Server.Version}}'")
+        ->toContain('sudo docker ps -a --filter label=coolify.githubRunner=true --format \'{{.Label "coolify.githubRunnerExecution"}} {{.Names}} {{.State}}\'');
+
+    $linesWithoutSudo = collect($parsed)->reject(fn (string $line) => str_starts_with($line, 'sudo ') || str_starts_with($line, 'echo '));
+    expect($linesWithoutSudo)->toBeEmpty();
+});