How to run self-hosted runner as root in linux so it can use docker?

[OmpahDev]

Select Topic Area

Question

Body

I've installed a self-hosted runner on a Linux VM that I have full access over. The runner itself works fine but whenever I try using docker on a workflow with that runner, the workflow fails with:

Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/version": dial unix /var/run/docker.sock: connect: permission denied
Error: The process '/usr/bin/docker' failed with exit code 1

I'm aware of why this happens - it's because docker needs to be run as root.

However, I can't figure out how to make the actions runner program run as root. If I try to run the ./config.sh and ./run.sh programs as root, the runner fails to start with a "Must not run as sudo" error.

I've seen discussion online that this problem is solved by adding a RUNNER_ALLOW_RUNASROOT=1 parameter when running the config script (ie. RUNNER_ALLOW_RUNASROOT=1 ./config.sh -url ... --token ...) but this does not solve the problem; nothing changes by doing this.

[montanizstills]

I am facing a similar issue, but the config.sh and run.sh script complains: "Must not run as sudo." This leads to a myriad of problems executing things from the action file as there are tons of permissions issues.

[montanizstills]

I also think its weird that you cannot run config.sh as sudo even if you are installing the runner as a service svc.sh install; svc.sh start svc.sh uses root but config.sh doesn't???? weird.

[airtower-luna]

I'm aware of why this happens - it's because docker needs to be run as root.

This is the core mistake here. If you want a user to be able to use Docker without further authentication, add that user to the docker group which owns the Docker socket (/var/run/docker.sock).

[alles60]

I'd also recommend this. Even if you do have total ownership of the machine, minimal permissions is always the best reflex to have. To allow my runners to run docker (to use container actions or other), I first set the user the runner is running as as a member of the docker group (you might need to create it). I then set the permissions of /var/run/docker.sock to 660, and set group ownership to the docker group. A reboot was necessary for me to get things running, but I think you can set these permissions in a more efficient way to not need a reboot.

[Raff-dev]

I know it's an old thread, but it doesn't really have a direct answer, so I'll throw in mine. There's an article on docker docs how to run in rootles mode. You probably don't want to run the runner as root, but you can give it access to docker. Have a look at the link below.
https://docs.docker.com/engine/security/rootless/

[github-actions[bot]]

🕒 Discussion Activity Reminder 🕒

This Discussion has been labeled as dormant by an automated system for having no activity in the last 60 days. Please consider one the following actions:

1️⃣ Close as Out of Date: If the topic is no longer relevant, close the Discussion as out of date at the bottom of the page.

2️⃣ Provide More Information: Share additional details or context — or let the community know if you've found a solution on your own.

3️⃣ Mark a Reply as Answer: If your question has been answered by a reply, mark the most helpful reply as the solution.

Note: This dormant notification will only apply to Discussions with the Question label. To learn more, see our recent announcement.

Thank you for helping bring this Discussion to a resolution! 💬

[cw1997]

Is there anyone from GitHub official supporter could answer this question? This question still bothers me for a long time. Thank you very much!

[nickvholbrook]

Not an ideal solution but a workaround if you're testing. Run below to allow the runner to run as root.

export RUNNER_ALLOW_RUNASROOT="1"