actions / actions/actions-runner-controller

update docker/runc version on summerwind/actions-runner

Open
#3,259 1 comment 8 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

community enhancement needs triage
Dominant language
Go
Stars
6.5k
Forks
1.5k
Avg merge
2d 2h
Merged PRs (30d)
27

Description

What would you like added? and Why is this needed?

As cause of the recent docker vulnerabilty https://snyk.io/blog/leaky-vessels-docker-runc-container-breakout-vulnerabilities/,
urrently the lastest version of summerwind/actions-runner contains Docker version 24.0.7, build afdd53b, Docker required to be updated to Docker Engine 4.25.2 and runc 1.1.12 which contains a fix CVE-2024-24557, CVE-2024-23650, CVE-2024-23651, CVE-2024-23652 and CVE-2024-23653 and CVE-2024-21626

Questions

Is there a faster way to update the docker/runc version for actions-runner-controller? my current k8s master/nodes are already updated to the latest version of runc

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

No file or test is named. Start by locating the runner image or dependency definitions that pin Docker 24.0.7 and runc, then check how this repository builds and publishes them. Done means the image uses the requested fixed versions and the cited vulnerabilities are addressed.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, kubernetes
Domain
devops, infrastructure
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.