fix(fw): pin podman 5.8.6 on the Forgejo runner VMs #405

Merged

dominik.polakovics merged 1 commit from fix/runner-podman-pin into main

2026-09-25 21:11:35 +02:00

dominik.polakovics commented

2026-09-25 21:10:34 +02:00

Owner

Problem

Every Forgejo Actions job that uses a uses: action (actions/checkout etc.) has failed on fj-runner-1/fj-runner-2 since 2026-09-24 00:00 UTC:

failed to copy content to container: Error response from daemon: statat var/run/act/actions/<hash>/.eslintignore: path escapes from parent

Jobs with only run: steps were unaffected, which is why it looked repo-specific.

Cause

The runner VMs picked up podman 5.8.7 from nixos-26.05 at 2026-09-23 22:00 UTC (fw generation 2036). 5.8.7 vendors buildah 1.43.4, whose CVE-2026-79705 fix extracts archives under an os.Root that refuses to follow absolute symlinks. act_runner copies actions with PUT /containers/{id}/archive?path=/ and entry paths var/run/act/actions/...; /var/run -> /run in the job image trips the check on the first entry.

Reproduced on fj-runner-1 through the podman socket: the same tar fails at path=/ and succeeds with entries relative to /var/run/act. Last passing checkout job 2026-09-23 21:49 UTC, first failing 2026-09-24 00:00 UTC, across renovate-config, freescout, nanoclaw and wohnservice-wien-typo3.

Upstream: podman-container-tools/podman#29805 (open), buildah fix podman-container-tools/buildah#7129 (open). Docker had the same regression (moby/moby#53258) and already fixed it.

Change

Pin virtualisation.podman.package on both runner VMs to podman 5.8.6 from nixpkgs c27cdad491a9, the last revision that shipped it. The podman module still applies its extraPackages/extraRuntimes override on top, so runtimes and the socket are unchanged.

Trade-off: 5.8.6 lacks the CVE-2026-79705 fix (path traversal during archive extraction). The extracted content on the runners is action repos the runner clones, so exposure is limited to workflows pulling a malicious action. Removal of the pin is tracked in #404, which includes the API reproduction to verify the fix.

Verification

pre-commit dry-build of fw passed.
After deploy: podman --version on 10.42.97.56/.57 shows 5.8.6 and the next renovate-config or freescout run passes its checkout step.

🤖 Generated with Claude Code

## Problem Every Forgejo Actions job that uses a `uses:` action (actions/checkout etc.) has failed on `fj-runner-1`/`fj-runner-2` since 2026-09-24 00:00 UTC: ``` failed to copy content to container: Error response from daemon: statat var/run/act/actions/<hash>/.eslintignore: path escapes from parent ``` Jobs with only `run:` steps were unaffected, which is why it looked repo-specific. ## Cause The runner VMs picked up podman 5.8.7 from nixos-26.05 at 2026-09-23 22:00 UTC (fw generation 2036). 5.8.7 vendors buildah 1.43.4, whose CVE-2026-79705 fix extracts archives under an `os.Root` that refuses to follow absolute symlinks. act_runner copies actions with `PUT /containers/{id}/archive?path=/` and entry paths `var/run/act/actions/...`; `/var/run -> /run` in the job image trips the check on the first entry. Reproduced on fj-runner-1 through the podman socket: the same tar fails at `path=/` and succeeds with entries relative to `/var/run/act`. Last passing checkout job 2026-09-23 21:49 UTC, first failing 2026-09-24 00:00 UTC, across renovate-config, freescout, nanoclaw and wohnservice-wien-typo3. Upstream: podman-container-tools/podman#29805 (open), buildah fix podman-container-tools/buildah#7129 (open). Docker had the same regression (moby/moby#53258) and already fixed it. ## Change Pin `virtualisation.podman.package` on both runner VMs to podman 5.8.6 from nixpkgs `c27cdad491a9`, the last revision that shipped it. The podman module still applies its `extraPackages`/`extraRuntimes` override on top, so runtimes and the socket are unchanged. Trade-off: 5.8.6 lacks the CVE-2026-79705 fix (path traversal during archive extraction). The extracted content on the runners is action repos the runner clones, so exposure is limited to workflows pulling a malicious action. Removal of the pin is tracked in #404, which includes the API reproduction to verify the fix. ## Verification - pre-commit dry-build of fw passed. - After deploy: `podman --version` on 10.42.97.56/.57 shows 5.8.6 and the next renovate-config or freescout run passes its checkout step. 🤖 Generated with [Claude Code](https://claude.com/claude-code)

dominik.polakovics added 1 commit

2026-09-25 21:10:34 +02:00

fix(fw): pin podman 5.8.6 on the Forgejo runner VMs 28a3916784

podman 5.8.7 (buildah 1.43.4) refuses archive entries that cross the
/var/run -> /run symlink, so act_runner can no longer copy actions into
the job container and every `uses:` step fails with "path escapes from
parent". Pin podman to 5.8.6 from the last nixpkgs revision that shipped
it until upstream lands the buildah fix; tracked in #404.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

dominik.polakovics merged commit 93b4f4e8e9 into main

2026-09-25 21:11:35 +02:00

dominik.polakovics deleted branch fix/runner-podman-pin

2026-09-25 21:11:35 +02:00

dominik.polakovics referenced this pull request from a commit

2026-09-25 21:11:36 +02:00

Merge pull request 'fix(fw): pin podman 5.8.6 on the Forgejo runner VMs' (#405) from fix/runner-podman-pin into main