[dtmtcm]

Their self-hosted runners are pretty jank. If your workflow writes something to the docker container's user's home directory, you will see it in the next workflow you run. Due to this and other things, I need a "preamble" action that needs to run right after checkout. Oh, if don't checkout at the beginning of your workflow, you will be using the previous workflow's copy of the repository.

I'm 100% sure they don't use this internally as these are glaring issues that impacts anyone using the self hosted runner. They also recommend running the container as root[1] instead of designing something more secure and sane.

1: https://github.com/actions/runner/issues/434#issuecomment-61...

[naikrovek]

it's not about security or sanity, it's because people run containers whose UIDs do not match the host system, and they write to the host system by mounting volumes for the container to use.

the result is root or another user inside the container can write root-owned files because they have the same UID as root on the container host.

my employer runs an orchestrator and destroys each runner VM after a single job so this only bites the user who causes it, and not anyone else.