Run the nested rootless Actions daemon with its required container privileges

Hop-State: A_06FN8AVQMJZ6K2X18A6G9X8 Hop-Proposal: R_06FN8ASRVT1DKJQJHGSYE68 Hop-Task: T_06FN8AMC0DGD5KW499HBX88 Hop-Attempt: AT_06FN8AMC0CCZXK2BZZ64DTG
2026-07-11 19:32:42 -07:00
parent 3dbebbbf1c
commit 5e754ae297
2 changed files with 20 additions and 3 deletions
@@ -60,9 +60,9 @@ services:
    cpus: "2.0"
    mem_limit: 4g
    pids_limit: 1024
-    security_opt:
-      - seccomp:unconfined
-      - apparmor:unconfined
+    # Required by rootlesskit for the nested Docker daemon. Workflow jobs run
+    # inside that daemon and never receive the host's Docker socket.
+    privileged: true
    volumes:
      - actions-runner-data:/data
    networks: [hopweb]