Anyway to Ensure GitHub Actions Jobs Are Running in Container on Self-Hosted Runners?

[ukewea]

Select Topic Area

Question

Body

Update:

If anyone has similar requirement like me, just add ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER=true to the .env file in your Actions Runner's installation directory (as @ChristopherHX pointed out).

For example, if my Actions Runner is in /data/actions-runner, just modify /data/actions-runner/.env, add a new line with text ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER=true, then restart the runner process.

No pre-run scripts required.

---

Hi everyone,

I'm running a self-hosted GitHub Actions runner and need every job to run inside a container. I discovered the feature that allows running a script before or after a job and planned to use it to stop any job not running in a container.

I implemented a script to run on job started and defined an environment hook as follows:

ACTIONS_RUNNER_HOOK_JOB_STARTED=/data/actions-runner-scripts/on_job_started.sh

However, it turns out the job runs when the job starts but before the container is created, as shown in the screenshot below, so there's no way to do the detection with this hook (as the container is not even started yet).

Is there any event where I can inject my script to ensure all jobs running on the runner all execute inside a container? or I should use other mechanism(s) achieve this?

Thanks.

---

For anyone interested, here's the script I used:

#!/bin/bash

# Check if the script is running inside a Docker container by checking for /.dockerenv
if [ ! -f /.dockerenv ]; then
  echo "::error ::This script must be run in a Docker container"
  exit 1
fi

echo "Running inside a Docker container. Proceeding with the script..."

[Saad-Ayady]

1

[ChristopherHX]

That's specfic usecase is covered by ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER see here

The ACTIONS_RUNNER_REQUIRE_JOB_CONTAINER env should be set to true to prevent the runner from running any jobs outside of a container

[ukewea]

Thanks @ChristopherHX, adding this environment variable to .env perfectly fits our need. I will update the original question for future readers' convenience.