fw: drop the podman 5.8.6 pin on the Forgejo runner VMs once upstream fixes the /var/run symlink regression #404

New issue

Open

opened 2026-09-25 21:08:03 +02:00 by dominik.polakovics · 0 comments

dominik.polakovics commented

2026-09-25 21:08:03 +02:00

Owner

Context

podman 5.8.7 (vendoring buildah 1.43.4 with the CVE-2026-79705 fix) rejects archive entries whose path crosses an absolute symlink inside the container, e.g. /var/run -> /run. act_runner copies every uses: action to /var/run/act/actions/<hash> via PUT /containers/{id}/archive?path=/, so every action-based job on fj-runner-1/fj-runner-2 failed with:

failed to copy content to container: Error response from daemon: statat var/run/act/actions/<hash>/.eslintignore: path escapes from parent

Failing since 2026-09-24 00:00 UTC, when the runner VMs picked up podman 5.8.7 from nixos-26.05. Jobs with only run: steps were unaffected.

Current state

hosts/fw/vms/forgejo-runner/default.nix pins virtualisation.podman.package to podman 5.8.6 from nixpkgs commit c27cdad491a991b11ed731760aa2ef8db0cb0410. That version predates the CVE-2026-79705 fix (path traversal during archive extraction), so the pin is a deliberate, temporary trade-off.

Upstream

podman issue: https://github.com/podman-container-tools/podman/issues/29805
buildah fix (open at time of writing): https://github.com/podman-container-tools/buildah/pull/7129
podman-side PR closed pending the buildah backport: https://github.com/podman-container-tools/podman/pull/29809

Done when

nixos-26.05 ships a podman that vendors a buildah containing the fix (5.8.8+ or a patched 5.8.7).
The podmanPinned binding and virtualisation.podman.package override are removed from hosts/fw/vms/forgejo-runner/default.nix.
A workflow using actions/checkout (e.g. Cloonar/freescout nightly or renovate/renovate-config) passes on both runners after the switch.

Verification for step 1: on a runner VM, podman version shows the new version and the API reproduction from the diagnosis passes:

c=$(podman create git.cloonar.com/infrastructure/gitea-runner:1.0.0 sleep 300); podman start $c
podman exec $c mkdir -p /var/run/act/actions/h
d=$(mktemp -d); mkdir -p $d/var/run/act/actions/h; echo a > $d/var/run/act/actions/h/x
tar -C $d --no-recursion -cf $d/a.tar var/run/act/actions/h/x
curl -s --unix-socket /run/podman/podman.sock -X PUT -H 'Content-Type: application/x-tar' --data-binary @$d/a.tar "http://d/containers/$c/archive?path=/"
podman rm -f -t 0 $c

An empty response means fixed; the path escapes from parent JSON means still broken.

## Context podman 5.8.7 (vendoring buildah 1.43.4 with the CVE-2026-79705 fix) rejects archive entries whose path crosses an absolute symlink inside the container, e.g. `/var/run -> /run`. act_runner copies every `uses:` action to `/var/run/act/actions/<hash>` via `PUT /containers/{id}/archive?path=/`, so every action-based job on `fj-runner-1`/`fj-runner-2` failed with: ``` failed to copy content to container: Error response from daemon: statat var/run/act/actions/<hash>/.eslintignore: path escapes from parent ``` Failing since 2026-09-24 00:00 UTC, when the runner VMs picked up podman 5.8.7 from nixos-26.05. Jobs with only `run:` steps were unaffected. ## Current state `hosts/fw/vms/forgejo-runner/default.nix` pins `virtualisation.podman.package` to podman 5.8.6 from nixpkgs commit `c27cdad491a991b11ed731760aa2ef8db0cb0410`. That version predates the CVE-2026-79705 fix (path traversal during archive extraction), so the pin is a deliberate, temporary trade-off. ## Upstream - podman issue: https://github.com/podman-container-tools/podman/issues/29805 - buildah fix (open at time of writing): https://github.com/podman-container-tools/buildah/pull/7129 - podman-side PR closed pending the buildah backport: https://github.com/podman-container-tools/podman/pull/29809 ## Done when 1. nixos-26.05 ships a podman that vendors a buildah containing the fix (5.8.8+ or a patched 5.8.7). 2. The `podmanPinned` binding and `virtualisation.podman.package` override are removed from `hosts/fw/vms/forgejo-runner/default.nix`. 3. A workflow using `actions/checkout` (e.g. `Cloonar/freescout` nightly or `renovate/renovate-config`) passes on both runners after the switch. Verification for step 1: on a runner VM, `podman version` shows the new version and the API reproduction from the diagnosis passes: ``` c=$(podman create git.cloonar.com/infrastructure/gitea-runner:1.0.0 sleep 300); podman start $c podman exec $c mkdir -p /var/run/act/actions/h d=$(mktemp -d); mkdir -p $d/var/run/act/actions/h; echo a > $d/var/run/act/actions/h/x tar -C $d --no-recursion -cf $d/a.tar var/run/act/actions/h/x curl -s --unix-socket /run/podman/podman.sock -X PUT -H 'Content-Type: application/x-tar' --data-binary @$d/a.tar "http://d/containers/$c/archive?path=/" podman rm -f -t 0 $c ``` An empty response means fixed; the `path escapes from parent` JSON means still broken.

dominik.polakovics added the

needs-triage

label

2026-09-25 21:08:03 +02:00

dominik.polakovics referenced this issue from a commit

2026-09-25 21:10:01 +02:00

fix(fw): pin podman 5.8.6 on the Forgejo runner VMs

dominik.polakovics referenced this issue

2026-09-25 21:10:34 +02:00

fix(fw): pin podman 5.8.6 on the Forgejo runner VMs #405

dominik.polakovics referenced this issue

2026-10-13 01:32:55 +02:00