Pick any line to see why it is the way it is: the commit, the pull request and issue it came from, and what the agent was thinking.
| Merge the runner sandbox: g1t-runner sandbox up makes a person's own computer a self-hosted runner that nothing a job runs can get out of. Linux jobs run in a Linux VM of the runner's own (a WSL 2 distribution with no host mounts, interop or Docker socket on Windows; vfkit on macOS; Sysbox, or QEMU and KVM, on Linux), each in a fresh container under Sysbox inside it; on Windows 11 Pro and up, Windows jobs each run in a Windows Sandbox discarded after the job. Runners report their isolation, and the Runners page shows it. | 1 | # syntax=docker/dockerfile:1.7 |
| 2 | # | |
| 3 | # The sandbox's Linux: what `g1t-runner sandbox up` runs on a person's own | |
| 4 | # computer, in a VM of the runner's own (crates/runner/src/selfhosted/launcher/). | |
| 5 | # It holds a Docker Engine with Sysbox and the runner's binary; the runner | |
| 6 | # itself runs as the runner's image (deploy/runner/Dockerfile) under | |
| 7 | # `--runtime=sysbox-runc`, as on a Linux server, and each job is a container | |
| 8 | # inside that. Three walls from the computer: the job's container, the | |
| 9 | # runner's Sysbox container, and the VM. | |
| 10 | # | |
| 11 | # Two targets, built by scripts/sandbox-image.mjs for each release: | |
| 12 | # | |
| 13 | # wsl A root filesystem for a WSL distribution on Windows (`wsl --import`), | |
| 14 | # with /etc/wsl.conf turning off drives, Windows programs and PATH. | |
| 15 | # vm The same with a kernel and systemd, made into a disk for a VM on | |
| 16 | # macOS (vfkit) or Linux (QEMU) with no shared folders. | |
| 17 | # | |
| 18 | # Build context: this folder plus `g1t-runner`, the static Linux build for | |
| 19 | # the image's platform. | |
| 20 | ||
| 21 | FROM docker:28-dind AS docker | |
| 22 | ||
| 23 | FROM debian:bookworm-slim AS sysbox | |
| 24 | ARG TARGETARCH | |
| 25 | # Sysbox 0.7 or later: earlier ones cannot run runc 1.2's checks of /proc | |
| 26 | # inside a Sysbox container ("unsafe procfs detected"), which Docker 28's | |
| 27 | # runc does. Pinned by SHA-256. | |
| 28 | ARG SYSBOX_VERSION=0.7.1 | |
| 29 | ARG SYSBOX_SHA256_AMD64=9d6d5484f980d0a17f86c492c1262015c2afb66280bdb97215b79fde6a0261c5 | |
| 30 | ARG SYSBOX_SHA256_ARM64=04ca894ae0b53f0fa54eaacc173ce40363c9a95ea5450f773716a84ef650a69b | |
| 31 | ADD https://github.com/nestybox/sysbox/releases/download/v${SYSBOX_VERSION}/sysbox-ce_${SYSBOX_VERSION}.linux_${TARGETARCH}.deb /tmp/sysbox.deb | |
| 32 | RUN expected="$([ "$TARGETARCH" = arm64 ] && echo "$SYSBOX_SHA256_ARM64" || echo "$SYSBOX_SHA256_AMD64")" \ | |
| 33 | && echo "$expected /tmp/sysbox.deb" | sha256sum -c - \ | |
| 34 | && dpkg-deb -x /tmp/sysbox.deb /tmp/sysbox \ | |
| 35 | && mkdir -p /out && cp /tmp/sysbox/usr/bin/sysbox-runc /tmp/sysbox/usr/bin/sysbox-mgr /tmp/sysbox/usr/bin/sysbox-fs /out/ | |
| 36 | ||
| 37 | FROM debian:bookworm-slim AS base | |
| 38 | # iptables: the engine's networks and the rules that keep jobs off the | |
| 39 | # computer; rsync and fuse3: Sysbox's; e2fsprogs and util-linux: the VM's | |
| 40 | # state disk. | |
| 41 | RUN apt-get update \ | |
| 42 | && apt-get install -y --no-install-recommends ca-certificates iptables rsync fuse3 procps kmod e2fsprogs util-linux \ | |
| 43 | && rm -rf /var/lib/apt/lists/* /var/cache/apt/* \ | |
| 44 | && mkdir -p /var/lib/g1t-sandbox/state /etc/docker | |
| 45 | COPY --from=docker /usr/local/bin/dockerd /usr/local/bin/containerd /usr/local/bin/containerd-shim-runc-v2 \ | |
| 46 | /usr/local/bin/runc /usr/local/bin/docker-proxy /usr/local/bin/docker-init /usr/local/bin/docker /usr/local/bin/ | |
| 47 | COPY --from=sysbox /out/ /usr/local/bin/ | |
| 48 | COPY --chmod=0755 g1t-runner /usr/local/bin/g1t-runner | |
| 49 | ARG IMAGE_VERSION=dev | |
| 50 | RUN echo "$IMAGE_VERSION" > /etc/g1t-sandbox-version | |
| 51 | ||
| 52 | FROM base AS wsl | |
| 53 | COPY wsl.conf /etc/wsl.conf | |
| 54 | ||
| 55 | FROM base AS vm | |
| 56 | # A kernel, an init, and the unit that runs the sandbox at boot. The VM's | |
| 57 | # console (hvc0) is where it says how it is (launcher/vm.rs reads it). | |
| 58 | RUN apt-get update \ | |
| 59 | && apt-get install -y --no-install-recommends systemd systemd-sysv "linux-image-cloud-$(dpkg --print-architecture)" \ | |
| 60 | && rm -rf /var/lib/apt/lists/* /var/cache/apt/* \ | |
| 61 | && echo g1t-sandbox > /etc/hostname \ | |
| 62 | && systemctl mask getty@tty1.service serial-getty@hvc0.service serial-getty@ttyS0.service | |
| 63 | COPY g1t-sandbox.service /etc/systemd/system/g1t-sandbox.service | |
| 64 | COPY vm-network.network /etc/systemd/network/80-g1t.network | |
| 65 | RUN systemctl enable g1t-sandbox.service systemd-networkd.service systemd-resolved.service |
This file's history is long; its oldest lines are credited to the oldest commit read.