Fix runner installer ID allocation and guards

docs/operations/CI_RUNNER.md

@@ -43,7 +43,8 @@ Production deployment is not automated.
 
 Review the root script and host audit output before running it. It installs
 `uidmap`, `dbus-user-session`, `curl`, `logrotate`, and Docker's rootless extras;
-creates the dedicated system user and subordinate ID range; reserves 15 GiB
+creates the dedicated system user and selects the first free, shared 65536-ID
+range from `/etc/subuid` and `/etc/subgid`; reserves 15 GiB
 for runner images/workspaces; and configures systemd services. It starts only
 the separate rootless Docker daemon; the runner and health timer stay disabled
 until repository registration. It does not change

infra/runner/find-free-subid-range.awk

@@ -0,0 +1,22 @@
+BEGIN { FS = ":" }
+/^[[:space:]]*$/ || /^[[:space:]]*#/ { next }
+NF != 3 || $2 !~ /^[0-9]+$/ || $3 !~ /^[0-9]+$/ || $3 < 1 { invalid = 1; next }
+{
+  start[FILENAME, ++count[FILENAME]] = $2
+  end[FILENAME, count[FILENAME]] = $2 + $3 - 1
+  files[FILENAME] = 1
+}
+END {
+  if (invalid || length(files) != 2) exit 2
+  for (base = 100000; base + 65535 <= 4294901760; base += 65536) {
+    overlap = 0
+    for (file in files)
+      for (i = 1; i <= count[file]; i++)
+        if (start[file, i] <= base + 65535 && end[file, i] >= base) overlap = 1
+    if (!overlap) {
+      print base "-" base + 65535
+      exit
+    }
+  }
+  exit 1
+}

infra/runner/install-runner.sh

@@ -28,12 +28,8 @@ done
 unsafe=$(find "$checkout" -xdev \( ! -user root -o -perm /022 \) -print -quit)
 [[ -z $unsafe ]] || die 'the repository checkout contains files writable by non-root users'
 git -C "$checkout" diff --quiet HEAD -- infra/runner || die 'runner files differ from the reviewed Git revision'
-if awk -F: '$2 <= 165535 && $2 + $3 - 1 >= 100000 { found=1 } END { exit !found }' /etc/subuid; then
-  die 'subuid range 100000-165535 overlaps an existing allocation; assign a free range before installing packages'
-fi
-if awk -F: '$2 <= 165535 && $2 + $3 - 1 >= 100000 { found=1 } END { exit !found }' /etc/subgid; then
-  die 'subgid range 100000-165535 overlaps an existing allocation; assign a free range before installing packages'
-fi
+[[ -r /etc/subuid && -r /etc/subgid ]] || die 'subordinate ID allocation files are unavailable'
+subid_range=$(awk -f "$(dirname "$0")/find-free-subid-range.awk" /etc/subuid /etc/subgid) || die 'could not find a free 65536-ID range shared by /etc/subuid and /etc/subgid'
 
 for path in "$runner_home" "$runner_image" "$runner_store" /etc/akyldash-runner; do
   [[ ! -e $path ]] || die "$path already exists; inspect it and follow the documented recovery procedure"
@@ -50,7 +46,7 @@ apt-get update
 DEBIAN_FRONTEND=noninteractive apt-get install -y uidmap dbus-user-session curl logrotate docker-ce-rootless-extras
 
 useradd --system --create-home --home-dir "$runner_home" --shell /usr/sbin/nologin "$runner_user"
-usermod --add-subuids 100000-165535 --add-subgids 100000-165535 "$runner_user"
+usermod --add-subuids "$subid_range" --add-subgids "$subid_range" "$runner_user"
 runner_uid=$(id -u "$runner_user")
 
 install -d -o "$runner_user" -g "$runner_user" -m 0700 "$runner_home" "$runner_store" "$runner_home/.config/docker" "$runner_home/.config/systemd/user/docker.service.d"

infra/runner/test-runner-config.sh

@@ -2,17 +2,47 @@
 set -Eeuo pipefail
 config=infra/runner/config.yaml
 installer=infra/runner/install-runner.sh
+assert_absent() {
+  local pattern=$1 file=$2
+  if grep -Eq "$pattern" "$file"; then
+    echo "Forbidden content matched in $file" >&2
+    return 1
+  fi
+}
 grep -Eq '^  capacity: 1$' "$config"
 grep -Fq 'akyldash-ci:docker://docker.gitea.com/runner-images:ubuntu-24.04' "$config"
 grep -Fq 'docker_host: "-"' "$config"
 grep -Eq '^  privileged: false$' "$config"
 grep -Eq '^  valid_volumes: \[\]$' "$config"
 grep -Fq -- '--cpus=2 --memory=3g --pids-limit=512' "$config"
-! grep -Eq 'var/run/docker.sock|metrics:|health_check:|production.env|review_secret' "$config"
+assert_absent 'var/run/docker.sock|metrics:|health_check:|production.env|review_secret' "$config"
 grep -Fq 'docker-ce-rootless-extras' "$installer"
 grep -Fq 'fallocate -l 15G' "$installer"
 grep -Fq 'runner_sha256=3acac8b506ac8cadc88a55155b5d6378f0fab0b8f62d1e0c0450f4ccd69733e2' "$installer"
-! grep -Eq 'usermod.*(sudo|docker)|/var/run/docker.sock|/etc/sudoers' "$installer"
+grep -Fq 'find-free-subid-range.awk' "$installer"
+grep -Fq 'usermod --add-subuids "$subid_range" --add-subgids "$subid_range"' "$installer"
+assert_absent 'usermod.*(sudo|docker)|/var/run/docker.sock|/etc/sudoers' "$installer"
 grep -Fq 'runs-on: akyldash-ci' .gitea/workflows/runner-smoke.yaml
-! grep -Eq 'deploy|production.env|review_secret|docker.sock' .gitea/workflows/runner-smoke.yaml
+grep -Fq 'test ! -S /var/run/docker.sock' .gitea/workflows/runner-smoke.yaml
+grep -Fq 'test ! -e /etc/akyldash/production.env' .gitea/workflows/runner-smoke.yaml
+grep -Fq 'test ! -e /etc/akyldash/review_secret' .gitea/workflows/runner-smoke.yaml
+assert_absent '(^|[[:space:]])(docker|docker-compose|deploy)([[:space:]]|$)|production.env=|review_secret=' .gitea/workflows/runner-smoke.yaml
+
+fixture=$(mktemp)
+fixture_g=$(mktemp)
+trap 'rm -f "$fixture" "$fixture_g"' EXIT
+printf 'production.env\n' >"$fixture"
+if assert_absent 'deploy|production.env|review_secret|docker.sock' "$fixture" 2>/dev/null; then
+  echo 'Negative guard regression: prohibited fixture was accepted' >&2
+  exit 1
+fi
+printf 'codex:100000:65536\n' >"$fixture"
+printf 'codex:165000:1000\n' >"$fixture_g"
+range=$(awk -f infra/runner/find-free-subid-range.awk "$fixture" "$fixture_g")
+[[ $range == 231072-296607 ]]
+printf 'broken\n' >"$fixture_g"
+if awk -f infra/runner/find-free-subid-range.awk "$fixture" "$fixture_g" >/dev/null 2>&1; then
+  echo 'Malformed subordinate ID allocation was accepted' >&2
+  exit 1
+fi
 echo 'runner configuration guards passed'