bircni 83b63250a3 fix: strip log-driver and OOM options when privileged is off (#1283) ...

When privileged mode is disabled, reset `--log-driver`, `--log-opt`, `--oom-score-adj` and `--oom-kill-disable` from workflow `container.options`. Log drivers run in the host daemon, so a workflow could make it connect to any address, and `--oom-score-adj -1000` exempts a job from the host OOM killer.

Breaking: on unprivileged runners, workflows can no longer set these options, e.g. `--log-driver none` or `--log-opt max-size=10m`. They are dropped with a warning and the job still runs. Runner-level `container.options` and privileged runners are unaffected.

Fixes: https://github.com/go-gitea/gitea/security/advisories/GHSA-cgx2-cw7h-xgcx
Fixes: https://github.com/go-gitea/gitea/security/advisories/GHSA-c988-q5xx-2cff
Co-authored-by: silverwind <2021+silverwind@noreply.gitea.com>
Co-authored-by: silverwind <me@silverwind.io>
Reviewed-on: https://gitea.com/gitea/runner/pulls/1283
Reviewed-by: silverwind <2021+silverwind@noreply.gitea.com>

2026-10-07 19:04:04 +00:00

..

testdata

…

container_types.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00

docker_auth.go

…

docker_build.go

…

docker_cli_test.go

…

docker_cli.go

…

docker_create_flags_test.go

…

docker_create_flags.go

…

docker_images_test.go

…

docker_images.go

fix: align Docker actions, job env and host mode with GitHub (#1268)

2026-10-01 19:45:13 +00:00

DOCKER_LICENSE

…

docker_logger.go

…

docker_network_test.go

…

docker_network.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00

docker_platform_test.go

…

docker_platform.go

…

docker_proxy_test.go

…

docker_proxy_unix.go

…

docker_proxy_windows.go

…

docker_proxy.go

…

docker_pull_test.go

…

docker_pull.go

…

docker_run_test.go

fix: strip log-driver and OOM options when privileged is off (#1283)

2026-10-07 19:04:04 +00:00

docker_run.go

fix: strip log-driver and OOM options when privileged is off (#1283)

2026-10-07 19:04:04 +00:00

docker_stub.go

…

docker_volume.go

…

executions_environment.go

…

helpers_test.go

…

host_environment_test.go

…

host_environment.go

…

kubernetes_client.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00

kubernetes_test.go

fix: extract copied directories at their destination in Kubernetes pods (#1286)

2026-10-05 11:05:17 +00:00

kubernetes.go

fix: extract copied directories at their destination in Kubernetes pods (#1286)

2026-10-05 11:05:17 +00:00

linux_container_environment_extensions_test.go

…

linux_container_environment_extensions.go

…

parse_env_file_test.go

…

parse_env_file.go

…

tar.go

feat: add Kubernetes backend (#1260)

2026-10-01 06:59:15 +00:00