trying to setup self hosted runners in GKE

[sravula84]

apiVersion: actions.summerwind.dev/v1alpha1
kind: RunnerDeployment
metadata:
name: github-action-ci
spec:
replicas: 1
template:
spec:
organization: xxx
labels:
- linux
env:
- name: RUNNER_FEATURE_FLAG_EPHEMERAL
value: "true"

---

apiVersion: actions.summerwind.dev/v1alpha1
kind: HorizontalRunnerAutoscaler
metadata:
name: deployment-runner-scaler
spec:
scaleTargetRef:
name: github-action-ci
minReplicas: 1
maxReplicas: 10
scaleUpTriggers:

• githubEvent: {}
  duration: "5m"

getting following error :
Failed to create pod resource {"runner": "githu-actions-runner-system/github-action-ci-tcvss-dkldf", "error": "admission webhook "gkepol │
│ icy.common-webhooks.networking.gke.io" denied the request: GKE Policy Controller rejected the request because it violates one or more policies: {"[denied by autogke-disallow-privile │
│ ge]":["container docker is privileged; not allowed in Autopilot"]}"}

i think the privilige is by default is false rt?

could you please suggest on this?

[kevholmes]

ARC will not work in GKE Autopilot as of early 2023 as that error message suggests: container docker is privileged; not allowed in Autopilot. Even with the rootless runner options, they are still running as privileged pods.

[kevholmes]

I suppose you could provide your own runner container without docker...

[sravula84]

can you give more details on that?

[sravula84]

some thing like below ?

To create a self-hosted runner in GKE that runs your own custom runner container without Docker, you can use the Summerwind Actions Runner Operator for Kubernetes. The operator provides a way to manage self-hosted runners as Kubernetes resources.

Here are the steps to create a self-hosted runner in GKE that runs your own custom runner container without Docker:

Create a Kubernetes secret that contains your GitHub personal access token:

lua
Copy code
kubectl create secret generic github-token --from-literal=token=
Create a Runner resource that specifies your runner configuration, including your custom runner container:

yaml
Copy code
apiVersion: actions.summerwind.dev/v1alpha1
kind: Runner
metadata:
name: my-runner
spec:
organization:
repository:
tokenSecret: github-token
image:
env:

• name: RUNNER_WORK_DIRECTORY
  value: /runner
  labels:
• my-runner-label

[kevholmes]

That solution above looks like it severely limits the best parts of ARC. Another option might be to fork the project, modify the rootless dind Dockerfile, strip out all the docker related items, along with the init/hook scripts that use docker, have those custom images built in Actions, pushed to GHCR and then pulled in by your RunnerSet or RunnerDeployment.

[MPV]

Anyone who's tried with GKE Sandbox / gVisor in combination with Autopilot and DinD?

Got a pointer from some Googlers the other day that it might be one way to do it.

Still researching this...