Need to make runner container privileged with dind

[efayen]

I deployed ARC controller with Helm chart v0.8.1, and a runner scale set with the Helm chart in the same version. It works fine.
Then, I tried to switch to dind mode with

containerMode:
  type: "dind"

From the resulting runner containers, access to the EmptyDir mounts (/home/runner/_work, /etc/hosts, /run/docker...) is denied, even as root (Permission denied).

After removing the containerMode.type, specifying the pod specification in values.yaml and making the runner container privileged, everything works, but I am surprised that this is necessary (and not very happy with privileged runner containers). Here is the complete values.yaml.

githubConfigUrl: *****

githubConfigSecret: pre-defined-secret

minRunners: 1
maxRunners: 10

template:
  spec:
    initContainers:
      - name: init-dind-externals
        image: ghcr.io/actions/actions-runner:latest
        command:
          ["cp", "-r", "-v", "/home/runner/externals/.", "/home/runner/tmpDir/"]
        volumeMounts:
          - name: dind-externals
            mountPath: /home/runner/tmpDir
    containers:
      - name: runner
        image: ghcr.io/actions/actions-runner:latest
        command: ["/home/runner/run.sh"]
        env:
          - name: DOCKER_HOST
            value: unix:///run/docker/docker.sock
          - name: RUNNER_WAIT_FOR_DOCKER_IN_SECONDS
            value: "120"
        # I needed to make the runner pod privileged. If not, the emptyDir
        # mounts cannot be accessed (permission denied, even as root).
        securityContext:
          privileged: true
        volumeMounts:
          - name: work
            mountPath: /home/runner/_work
          - name: dind-sock
            mountPath: /run/docker
            readOnly: true
      - name: dind
        image: docker:dind
        args:
          - dockerd
          - --host=unix:///run/docker/docker.sock
          - --group=$(DOCKER_GROUP_GID)
        env:
          - name: DOCKER_GROUP_GID
            value: "123"
        securityContext:
          privileged: true
        volumeMounts:
          - name: work
            mountPath: /home/runner/_work
          - name: dind-sock
            mountPath: /run/docker
          - name: dind-externals
            mountPath: /home/runner/externals
    volumes:
      - name: work
        emptyDir: {}
      - name: dind-sock
        emptyDir: {}
      - name: dind-externals
        emptyDir: {}

I am forced to use a K8s cluster v1.21.14. Has anyone faced similar issues ? Happy to take any idea to improve the situation (upgrading the K8s version is not in my power though...) !