actions / actions/actions-runner-controller
update docker/runc version on summerwind/actions-runner
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 6.5k
- Forks
- 1.5k
- Avg merge
- 2d 2h
- Merged PRs (30d)
- 27
Description
What would you like added? and Why is this needed?
As cause of the recent docker vulnerabilty https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/,
urrently the lastest version of summerwind/actions-runner contains Docker version 24.0.7, build afdd53b, Docker required to be updated to Docker Engine 4.25.2 and runc 1.1.12 which contains a fix CVE-2024-24557, CVE-2024-23650, CVE-2024-23651, CVE-2024-23652 and CVE-2024-23653 and CVE-2024-21626
Questions
Is there a faster way to update the docker/runc version for actions-runner-controller? my current k8s master/nodes are already updated to the latest version of runc
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
No file or test is named. Start by locating the runner image or dependency definitions that pin Docker 24.0.7 and runc, then check how this repository builds and publishes them. Done means the image uses the requested fixed versions and the cited vulnerabilities are addressed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, kubernetes
- Domain
- devops, infrastructure
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 35/100