runnerd_core/
isolation.rs

1//! How a runner container is kept from the host while it runs its own Docker Engine. A backend decides only how
2//! the container is created; its name, limits, labels and slice are the same for every backend (`docker`).
3
4use std::fmt;
5
6use bollard::models::HostConfig;
7
8use crate::config;
9
10/// An isolation backend: how runner containers are created so their Docker Engine cannot reach the host.
11pub trait Isolation: Send + Sync + fmt::Debug {
12    /// The name `runnerd.toml` uses, also put on the container's `runnerd.isolation` label.
13    fn name(&self) -> &'static str;
14    /// Whether a job in the container can take over the host.
15    fn is_unsafe(&self) -> bool;
16    /// Sets the container's runtime and privileges.
17    fn configure(&self, host_config: &mut HostConfig);
18}
19
20/// Sysbox runs Docker inside an unprivileged container, in its own user namespace.
21#[derive(Debug)]
22pub struct Sysbox;
23
24impl Isolation for Sysbox {
25    fn name(&self) -> &'static str {
26        "sysbox"
27    }
28
29    fn is_unsafe(&self) -> bool {
30        false
31    }
32
33    fn configure(&self, host_config: &mut HostConfig) {
34        host_config.runtime = Some("sysbox-runc".to_owned());
35        host_config.privileged = Some(false);
36    }
37}
38
39/// Privileged Docker-in-Docker: root in the container is root on the host.
40#[derive(Debug)]
41pub struct UnsafeDind;
42
43impl Isolation for UnsafeDind {
44    fn name(&self) -> &'static str {
45        "unsafe-dind"
46    }
47
48    fn is_unsafe(&self) -> bool {
49        true
50    }
51
52    fn configure(&self, host_config: &mut HostConfig) {
53        // Named, not left to the Engine's default runtime, which may be sysbox-runc.
54        host_config.runtime = Some("runc".to_owned());
55        host_config.privileged = Some(true);
56    }
57}
58
59/// The backend `runnerd.toml` names.
60pub fn backend(isolation: config::Isolation) -> &'static dyn Isolation {
61    match isolation {
62        config::Isolation::Sysbox => &Sysbox,
63        config::Isolation::UnsafeDind => &UnsafeDind,
64    }
65}
66
67#[cfg(test)]
68mod tests;
runnerd_core/isolation.rs

runnerd_core/
isolation.rs
