Change the runner unit from ProtectHome=yes to ProtectHome=read-only, making /run/user visible while preserving existing home and root protections.
Preserve the existing /run/user/$uidReadWritePaths carve-out used by the rootless runtime.
Add regression assertions and update runner and current-state documentation.
This is a narrow replacement for the runner ProtectHome portion of PR #46. PR #46 remains open and unchanged. No VPS unit was modified.
Verification
Read-only SSH confirmed the live runner is active with ProtectHome=read-only and the /run/user/999 writable carve-out.
bash infra/runner/test-runner-config.sh passed.
The broader local suite passed before this follow-up: backend 57 passed (1 skipped), Telegram 6, backup 16, deploy 48, and runner/bootstrap/Compose guards.
CI and runner smoke are pending for the current head.
## Changes
- Change the runner unit from `ProtectHome=yes` to `ProtectHome=read-only`, making `/run/user` visible while preserving existing home and root protections.
- Preserve the existing `/run/user/$uid` `ReadWritePaths` carve-out used by the rootless runtime.
- Add regression assertions and update runner and current-state documentation.
This is a narrow replacement for the runner `ProtectHome` portion of PR #46. PR #46 remains open and unchanged. No VPS unit was modified.
## Verification
- Read-only SSH confirmed the live runner is active with `ProtectHome=read-only` and the `/run/user/999` writable carve-out.
- `bash infra/runner/test-runner-config.sh` passed.
- The broader local suite passed before this follow-up: backend 57 passed (1 skipped), Telegram 6, backup 16, deploy 48, and runner/bootstrap/Compose guards.
- CI and runner smoke are pending for the current head.
Initial review of the complete PR at d6799ec5: ProtectHome=read-only matches the owner-verified live runner unit; the existing /run/user/$runner_uid ReadWritePaths carve-out remains intact for rootless Docker. No codex log ACL or job socket exposure added. Version references and docs explain the writable exception. Runner config, guard, installer idempotency, syntax, and backend tests passed; CI #119 and smoke #120 succeeded. No blocking findings.
Initial review of the complete PR at d6799ec5: ProtectHome=read-only matches the owner-verified live runner unit; the existing /run/user/$runner_uid ReadWritePaths carve-out remains intact for rootless Docker. No codex log ACL or job socket exposure added. Version references and docs explain the writable exception. Runner config, guard, installer idempotency, syntax, and backend tests passed; CI #119 and smoke #120 succeeded. No blocking findings.
Final review of the complete PR at 1f6129e0, including the restored /run/user/$runner_uid ReadWritePaths carve-out, systemd documentation, version references, and changelog. No codex log ACL or job socket exposure. Local runner config/idempotency and backend tests passed; CI #121 and smoke #122 succeeded on this exact head. No blocking findings.
Final review of the complete PR at 1f6129e0, including the restored /run/user/$runner_uid ReadWritePaths carve-out, systemd documentation, version references, and changelog. No codex log ACL or job socket exposure. Local runner config/idempotency and backend tests passed; CI #121 and smoke #122 succeeded on this exact head. No blocking findings.
agent
merged commit 84ae32b8a3 into main2026-10-21 06:04:16 +00:00
Blocking a user prevents them from interacting with repositories, such as opening or commenting on pull requests or issues. Learn more about blocking a user.
agent
Changes
ProtectHome=yestoProtectHome=read-only, making/run/uservisible while preserving existing home and root protections./run/user/$uidReadWritePathscarve-out used by the rootless runtime.This is a narrow replacement for the runner
ProtectHomeportion of PR #46. PR #46 remains open and unchanged. No VPS unit was modified.Verification
ProtectHome=read-onlyand the/run/user/999writable carve-out.bash infra/runner/test-runner-config.shpassed.Initial review of the complete PR at
d6799ec5: ProtectHome=read-only matches the owner-verified live runner unit; the existing /run/user/$runner_uid ReadWritePaths carve-out remains intact for rootless Docker. No codex log ACL or job socket exposure added. Version references and docs explain the writable exception. Runner config, guard, installer idempotency, syntax, and backend tests passed; CI #119 and smoke #120 succeeded. No blocking findings.New commits pushed, approval review dismissed automatically according to repository settings
Final review of the complete PR at
1f6129e0, including the restored /run/user/$runner_uid ReadWritePaths carve-out, systemd documentation, version references, and changelog. No codex log ACL or job socket exposure. Local runner config/idempotency and backend tests passed; CI #121 and smoke #122 succeeded on this exact head. No blocking findings.