From 907a7195123613d9f41002db2b03b9f7f931408a Mon Sep 17 00:00:00 2001 From: Claude Date: Sat, 4 Jul 2026 13:35:34 +0000 Subject: [PATCH] =?UTF-8?q?docs:=20=F0=9F=94=92=20document=20the=20new=20o?= =?UTF-8?q?ne-time=20broker=20elevation=20flow?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The package builder's elevated mode was reworked: the install no longer fails on purpose, and the manual root step becomes a single reviewable 'sudo /var/packages/GithubRunner/scripts/elevate' command that grants the package user access to a root-owned broker instead of flipping the whole package to run-as root. Update the installation steps accordingly, add security notes about the Docker socket and the access token, and fix the Releases link pointing to a misspelled repository name. Also allow fine-grained personal access tokens in the install wizard: the previous validator only accepted exactly 40 characters, rejecting the more secure github_pat_* tokens. Co-Authored-By: Claude Fable 5 Claude-Session: https://claude.ai/code/session_01R1PGYcSzo7GMyvgxFumZJ6 --- README.md | 27 +++++++++++++++++++------- synology/WIZARD_UIFILES/install_uifile | 2 +- 2 files changed, 21 insertions(+), 8 deletions(-) diff --git a/README.md b/README.md index 601b79d..271a288 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,7 @@ This package allows you to run GitHub Actions on your Synology NAS. It uses the ## Installation -1. Download the package from the [Releases](https://github.com/tomgrv/github-runner-synology/releases) page. +1. Download the package from the [Releases](https://github.com/tomgrv/synology-github-runner/releases) page. 2. Open the Synology Package Center. @@ -16,14 +16,27 @@ This package allows you to run GitHub Actions on your Synology NAS. It uses the 4. Follow the installation instructions. -**The package will go in error state initially, but this is expected as it needs to be elevated to run properly.** +**The package installs cleanly but stays stopped: DSM 7 does not allow unsigned packages to manage Docker containers, so it needs a one-time approval to run.** -5. Elevate the package by following the instructions from the [Synology Package Builder](https://github.com/tomgrv/synology-package-builder/blob/main/doc/elevated.md) +5. Approve the package from a root shell (SSH): -6. After elevation, the package will: - - Download the docker image (takes a while, you shoud receive a notification from Container Manager when done) - - Create a Docker container in the Container Manager. This container will be read-only and named `github-runner` - - Behave as a regular Package, allowing you to start/stop it from the Package Center. + ```bash + sudo /var/packages/GithubRunner/scripts/elevate + ``` + + The command shows exactly what it is approving (image, container name, privileged mode, volume bindings) before doing anything. It then installs a root-owned broker restricted to managing this package's container — the package itself keeps running as its unprivileged user. See the [elevation documentation](https://github.com/tomgrv/synology-package-builder/blob/main/doc/elevated.md) for the full security model. + +6. After approval, the package will: + - Download the docker image (takes a while) + - Create a Docker container in the Container Manager, named `github-runner` + - Behave as a regular package, allowing you to start/stop it from the Package Center. + +The approval survives package upgrades. When an upgrade ships a new runner image, the package asks you to re-run the command above to review and approve the change. Uninstalling the package removes the container and revokes the approval entirely. + +## Security notes + +- The runner container mounts the Docker socket, which is equivalent to root access on the NAS: only register it against an organisation or repositories you trust, and prefer a fine-grained token restricted to runner registration. +- The access token is only used to register the runner; it is stored in the package home and in the approved container profile, both readable by root and the package user only. ## Credits diff --git a/synology/WIZARD_UIFILES/install_uifile b/synology/WIZARD_UIFILES/install_uifile index c4c64dd..492fd72 100644 --- a/synology/WIZARD_UIFILES/install_uifile +++ b/synology/WIZARD_UIFILES/install_uifile @@ -13,7 +13,7 @@ "validator": { "allowBlank": false, "minLength": 40, - "maxLength": 40 + "maxLength": 255 } }, {