Skip to content

Add optional Runpod untrusted-caller lab #6

Add optional Runpod untrusted-caller lab

Add optional Runpod untrusted-caller lab #6

Workflow file for this run

name: Verification
'on':
pull_request:
push:
branches:
- main
workflow_dispatch:
permissions:
contents: read
jobs:
clean-container-smoke:
name: Clean Docker and real-swtpm smoke
runs-on: ubuntu-24.04
timeout-minutes: 45
steps:
- name: Check out source
uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6.1.0
with:
persist-credentials: false
- name: Install pinned uv
uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
with:
version: "0.12.5"
enable-cache: false
- name: Audit locked core and worker dependencies
run: |
uv sync --frozen --extra dev
uv run --frozen pip-audit
uv run --frozen pip-audit \
-r examples/runpod-untrusted-caller/requirements.lock
- name: Validate Compose configuration
run: docker compose config --quiet
- name: Build verification image without cache
run: docker compose build --pull --no-cache
- name: Run verification against real swtpm
run: docker compose up --abort-on-container-exit --exit-code-from verify verify
- name: Remove containers, volumes, and network
if: always()
run: docker compose down --volumes --remove-orphans
- name: Build isolated untrusted-caller worker
run: |
docker build --platform linux/amd64 \
--tag atcap-runpod-holder:ci \
examples/runpod-untrusted-caller
- name: Run worker smoke without network or privileges
run: |
docker run --rm --platform linux/amd64 --network none --read-only \
--env TMPDIR=/run/worker-tmp \
--tmpfs /run/worker-tmp:rw,noexec,nosuid,size=16m \
--cap-drop ALL --security-opt no-new-privileges \
atcap-runpod-holder:ci sh -c \
'python /opt/worker/self_test.py && python /opt/worker/handler_self_test.py'
test "$(docker image inspect atcap-runpod-holder:ci --format '{{.Architecture}}')" = amd64
test "$(docker image inspect atcap-runpod-holder:ci --format '{{.Config.User}}')" = 10001:10001