build(image): a python command for shell: python; contrib: systemd unit

commit: dddf7abb46f5a0903cf325b7b5371ecc607554be
author: brice · 9d ago · 2026-10-12 18:55 UTC
parent: 35d0c10
signature: GPG VerifiedCD88F9E564E0102646FB6077A1A07C7C7C3E349D · arch-gpg Verified for the committer email

2 files · +41 -1

A contrib/ermite-runner.service +40 -0

@@ -0,0 +1,40 @@
	1	+	# SPDX-License-Identifier: MIT
	2	+	#
	3	+	# systemd unit of the ermite runner. Install the static binary as
	4	+	# /usr/local/bin/ermite-runner, write the settings to
	5	+	# /etc/ermite-runner/env (mode 0600) and register the runner once:
	6	+	#
	7	+	# sudo systemd-run --pipe --wait -p EnvironmentFile=/etc/ermite-runner/env \
	8	+	# /usr/local/bin/ermite-runner register --token <runner:register token>
	9	+	#
	10	+	# The runner runs as root: it creates TAP devices and firewall rules (vm), loop
	11	+	# mounts (container), and starts the jailer or containers. Jobs never run as
	12	+	# root on the host; they run in a micro-VM or a container as user "runner".
	13	+	[Unit]
	14	+	Description=ermite CI runner
	15	+	Documentation=https://git.bnema.dev/bnema/ermite-runner
	16	+	Wants=network-online.target
	17	+	After=network-online.target docker.service
	18	+
	19	+	[Service]
	20	+	Type=simple
	21	+	EnvironmentFile=/etc/ermite-runner/env
	22	+	ExecStart=/usr/local/bin/ermite-runner run
	23	+	Restart=on-failure
	24	+	RestartSec=5
	25	+	# SIGTERM cancels the running jobs with runner_shutdown, reports them and
	26	+	# removes their sandboxes; give that time before systemd sends SIGKILL.
	27	+	KillMode=mixed
	28	+	KillSignal=SIGTERM
	29	+	TimeoutStopSec=120
	30	+	# The state directory holds the runner token (0600) and the VM images.
	31	+	StateDirectory=ermite-runner
	32	+	StateDirectoryMode=0700
	33	+	RuntimeDirectory=ermite-runner
	34	+	# Jobs are many processes: do not let systemd's default task limit stop them.
	35	+	TasksMax=infinity
	36	+	LimitNOFILE=1048576
	37	+	Delegate=yes
	38	+
	39	+	[Install]
	40	+	WantedBy=multi-user.target

@@ -0,0 +1,40 @@
	1	+	# SPDX-License-Identifier: MIT
	2	+	#
	3	+	# systemd unit of the ermite runner. Install the static binary as
	4	+	# /usr/local/bin/ermite-runner, write the settings to
	5	+	# /etc/ermite-runner/env (mode 0600) and register the runner once:
	6	+	#
	7	+	# sudo systemd-run --pipe --wait -p EnvironmentFile=/etc/ermite-runner/env \
	8	+	# /usr/local/bin/ermite-runner register --token <runner:register token>
	9	+	#
	10	+	# The runner runs as root: it creates TAP devices and firewall rules (vm), loop
	11	+	# mounts (container), and starts the jailer or containers. Jobs never run as
	12	+	# root on the host; they run in a micro-VM or a container as user "runner".
	13	+	[Unit]
	14	+	Description=ermite CI runner
	15	+	Documentation=https://git.bnema.dev/bnema/ermite-runner
	16	+	Wants=network-online.target
	17	+	After=network-online.target docker.service
	18	+
	19	+	[Service]
	20	+	Type=simple
	21	+	EnvironmentFile=/etc/ermite-runner/env
	22	+	ExecStart=/usr/local/bin/ermite-runner run
	23	+	Restart=on-failure
	24	+	RestartSec=5
	25	+	# SIGTERM cancels the running jobs with runner_shutdown, reports them and
	26	+	# removes their sandboxes; give that time before systemd sends SIGKILL.
	27	+	KillMode=mixed
	28	+	KillSignal=SIGTERM
	29	+	TimeoutStopSec=120
	30	+	# The state directory holds the runner token (0600) and the VM images.
	31	+	StateDirectory=ermite-runner
	32	+	StateDirectoryMode=0700
	33	+	RuntimeDirectory=ermite-runner
	34	+	# Jobs are many processes: do not let systemd's default task limit stop them.
	35	+	TasksMax=infinity
	36	+	LimitNOFILE=1048576
	37	+	Delegate=yes
	38	+
	39	+	[Install]
	40	+	WantedBy=multi-user.target

M images/ubuntu-24.04/Dockerfile +1 -1


@@ -12,7 +12,7 @@ ARG DEBIAN_FRONTEND=noninteractive
12	12		RUN apt-get update \
13	13		&& apt-get install -y --no-install-recommends \
14	14		bash build-essential ca-certificates curl e2fsprogs git gnupg iproute2 \
15		-	iptables jq kmod procps python3 sudo tzdata unzip xz-utils zip \
	15	+	iptables jq kmod procps python-is-python3 python3 sudo tzdata unzip xz-utils zip \
16	16		&& rm -rf /var/lib/apt/lists/*
17	17
18	18		# Docker Engine from Docker's apt repository (the job gets its own daemon).


@@ -12,7 +12,7 @@ ARG DEBIAN_FRONTEND=noninteractive
12		RUN apt-get update \	12		RUN apt-get update \
13		&& apt-get install -y --no-install-recommends \	13		&& apt-get install -y --no-install-recommends \
14		bash build-essential ca-certificates curl e2fsprogs git gnupg iproute2 \	14		bash build-essential ca-certificates curl e2fsprogs git gnupg iproute2 \
15	-	iptables jq kmod procps python3 sudo tzdata unzip xz-utils zip \	15	+	iptables jq kmod procps python-is-python3 python3 sudo tzdata unzip xz-utils zip \
16		&& rm -rf /var/lib/apt/lists/*	16		&& rm -rf /var/lib/apt/lists/*
17			17
18		# Docker Engine from Docker's apt repository (the job gets its own daemon).	18		# Docker Engine from Docker's apt repository (the job gets its own daemon).