trixi-framework / ci-with-self-hosted-runners Goto Github PK

At the moment, dockerd runs as root. This increases the potential for destructive operations if a job manages to break out of the Docker container. Thus, it would be good to configure Docker to run with a non-root user, as described, e.g., on https://docs.docker.com/engine/security/rootless/.

At the moment, there are no restrictions on the processes in each Docker container. We should consider limiting the resource usage (e.g., number of cores, memory usage) to avoid that a badly behaved job can jeopardize the entire system. At the very least, we should limit the amount of data can be stored on disk, such that the host machine cannot be crashed by filling up the disk.

Besides #1, it would be good to investigate other measures that can/should be taken to make running Docker containers on shared systems more secure.