mandersson/podmanrunner
1
0
Fork 0
Code Issues Pull requests Packages Projects Releases Wiki Activity

Create a new user for each rootless runner container

Browse source
This commit is contained in:
Magnus Andersson 2024-01-19 09:33:10 +01:00
parent edfc201cc2
commit 92740834a2
Signed by: mandersson
GPG key ID: 19CB2C58E1F19B16
1 changed files with 31 additions and 26 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

57
manifests/runner.pp
View file

@ -3,13 +3,7 @@ class podmanrunner::runner (
Integer $replicas = 2, Integer $replicas = 2,
) )
{ {
user { 'podmanuser': $username='runneruser'
ensure => present,
home => '/opt/podmanuser',
shell => '/usr/sbin/nologin',
uid => '1001',
managehome => true,
}
package { 'podman': package { 'podman':
ensure => installed, ensure => installed,
provider => apt, provider => apt,
@ -20,26 +14,37 @@ class podmanrunner::runner (
provider => apt, provider => apt,
} }
file { '/opt/podmanuser/docker-compose.yaml': range(1,$replicas).each |$x| {
ensure => file,
content => template('podmanrunner/docker-compose.yaml.erb'),
owner => 'podmanuser',
group => 'podmanuser',
mode => '0600',
}
file { '/opt/podmanuser/bin': user { "${username}${x}":
ensure => directory, ensure => present,
mode => '0700', home => "/opt/${username}${x}",
owner => 'podmanuser', shell => '/usr/sbin/nologin',
group => 'podmanuser', uid => "${ $x + 1001}",
} managehome => true,
}
file { '/opt/podmanuser/bin/podman-compose': file { "/opt/${username}${x}/docker-compose.yaml":
ensure => file, ensure => file,
mode => '500', content => template('podmanrunner/docker-compose.yaml.erb'),
source => 'puppet:///modules/podmanrunner/podman-compose', owner => "${username}${x}",
owner => 'podmanuser', group => "${username}${x}",
group => 'podmanuser', mode => '0600',
}
file { "/opt/${username}${x}/bin":
ensure => directory,
mode => '0700',
owner => "${username}${x}",
group => "${username}${x}",
}
file { "/opt/${username}${x}/bin/podman-compose":
ensure => file,
mode => '500',
source => 'puppet:///modules/podmanrunner/podman-compose',
owner => "${username}${x}",
group => "${username}${x}",
}
} }
} }