Skip to content

fix(runner): rebuild Go tools with patched compiler and network modules #462

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
alvaroloes merged 2 commits into from
Oct 19, 2026
Merged

fix(runner): rebuild Go tools with patched compiler and network modules #462

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
34e175f
fix(runner): rebuild Go tools with patched compiler and network modules
alvaroloes Oct 15, 2026
7cbef19
fix(runner): use Docker CLI reviewed module graph for patched builds
alvaroloes Oct 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions apps/docs/docs/reference/security.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -128,3 +128,19 @@ and retention policy must cover both workspace storage and PostgreSQL.

For deployment controls, key rotation, logging, backups, network policy, and incident preparation,
continue with the [hardening guide](hardening.md).

### Runner Go toolchain security floor

The runner rebuilds its pinned Docker, containerd, RootlessKit, Buildx, Compose,
runc and GitHub CLI sources with Go 1.26.9. That patch release contains the
October 2026 standard-library security fixes. Every source build also replaces
`golang.org/x/net` with v0.60.0, including the Docker CLI and runc builds that
otherwise use their vendored copies. The image build checks the compiler and
effective x/net version embedded in each resulting binary.

This updates build dependencies without changing the tool releases, workspace
permissions, retention behavior or existing scanner exceptions. The release
image scanner and Docker-backed workspace acceptance tier remain required.

References: [Go security release history](https://go.dev/doc/devel/release) and
[x/net v0.60.0](https://pkg.go.dev/golang.org/x/net@v0.60.0).
35 changes: 27 additions & 8 deletions runner/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,7 +8,7 @@ FROM docker:29-dind-rootless@sha256:8a213afdd096a44dff403aaf8eb58b7a96a63113f18a
# toolchain that contains the reviewed standard-library fixes. The upstream
# image still supplies its shell bootstrap and docker-init; every Go binary
# that crosses into the runner is rebuilt from a checksum-pinned source commit.
FROM golang:1.26.6-trixie@sha256:b75d466dd608587fd66cca705a307ba65b889827d06ad61d6a75f0482b51b7c7 AS go-tools-base
FROM golang:1.26.9-trixie@sha256:f06b7122f888680048afb247c4e5f49c0069eb6c4c1ccae0f3f4834527a8d22c AS go-tools-base
RUN apt-get update \
&& apt-get install -y --no-install-recommends ca-certificates curl libseccomp-dev pkg-config \
&& rm -rf /var/lib/apt/lists/*
Expand All @@ -34,6 +34,7 @@ RUN archive=/tmp/moby.tar.gz \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& cd /src \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& go mod edit -replace=golang.org/x/mod=golang.org/x/mod@v0.40.0 \
&& go mod edit -replace=google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
&& VERSION="$MOBY_VERSION" DOCKER_GITCOMMIT="$MOBY_COMMIT" \
Expand All @@ -57,9 +58,16 @@ RUN archive=/tmp/docker-cli.tar.gz \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& ln -s /src /go/src/github.com/docker/cli \
&& cd /go/src/github.com/docker/cli \
# Docker CLI keeps its reviewed module graph in vendor.mod/vendor.sum. \
&& cp vendor.mod go.mod \
&& cp vendor.sum go.sum \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/mod=golang.org/x/mod@v0.40.0 \
&& go mod edit -replace=google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
&& VERSION="$DOCKER_CLI_VERSION" GITCOMMIT="$DOCKER_CLI_COMMIT" \
CGO_ENABLED=0 GO_LINKMODE=static DISABLE_WARN_OUTSIDE_CONTAINER=1 \
SOURCE_DATE_EPOCH=1785456000 ./scripts/build/binary \
SOURCE_DATE_EPOCH=1785456000 GOFLAGS=-mod=mod ./scripts/build/binary \
&& install -m 0755 "build/docker-linux-$(go env GOARCH)" /out/docker \
&& test "$(/out/docker --version | awk '{print $3}' | tr -d ',')" = "$DOCKER_CLI_VERSION" \
&& rm -rf /src "$archive" /root/.cache/go-build /go/pkg/mod /go/src/github.com/docker/cli
Expand All @@ -76,7 +84,7 @@ RUN archive=/tmp/containerd.tar.gz \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& cd /src \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& go mod edit -replace=golang.org/x/mod=golang.org/x/mod@v0.40.0 \
&& go mod edit -replace=google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
&& make VERSION="v${CONTAINERD_VERSION}" REVISION="$CONTAINERD_COMMIT" STATIC=1 \
Expand All @@ -98,7 +106,7 @@ RUN archive=/tmp/rootlesskit.tar.gz \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& cd /src \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& CGO_ENABLED=0 go build -mod=mod -trimpath -ldflags='-s -w' -o /out/rootlesskit ./cmd/rootlesskit \
&& test "$(/out/rootlesskit --version | awk '{print $3}')" = "3.0.2" \
&& rm -rf /src "$archive" /root/.cache/go-build /go/pkg/mod
Expand All @@ -116,6 +124,7 @@ RUN archive=/tmp/buildx.tar.gz \
&& cd /src \
&& go mod edit -replace=github.com/moby/go-archive=github.com/moby/go-archive@v0.3.0 \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& go mod edit -replace=golang.org/x/mod=golang.org/x/mod@v0.40.0 \
&& go mod edit -replace=google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
&& CGO_ENABLED=0 go build -mod=mod -trimpath \
Expand All @@ -138,6 +147,7 @@ RUN archive=/tmp/compose.tar.gz \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& cd /src \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& go mod edit -replace=golang.org/x/mod=golang.org/x/mod@v0.40.0 \
&& go mod edit -replace=google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
&& CGO_ENABLED=0 GOMAXPROCS=1 go build -p=1 -mod=mod -trimpath -tags=e2e \
Expand All @@ -156,8 +166,10 @@ RUN archive=/tmp/runc.tar.gz \
&& printf '%s %s\n' "$RUNC_SOURCE_SHA256" "$archive" | sha256sum --check --strict \
&& mkdir -p /src /out \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& make -C /src runc \
&& test "$(/src/runc --version | awk '/^go:/{print $2}')" = "go1.26.6" \
&& cd /src \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& GOFLAGS=-mod=mod make -C /src runc \
&& test "$(/src/runc --version | awk '/^go:/{print $2}')" = "go1.26.9" \
&& install -m 0755 /src/runc /out/runc \
&& rm -rf /src "$archive" /root/.cache/go-build /go/pkg/mod

Expand All @@ -173,6 +185,7 @@ RUN archive=/tmp/gh.tar.gz \
&& tar -xzf "$archive" --strip-components=1 -C /src \
&& cd /src \
&& go mod edit -replace=golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
&& go mod edit -replace=golang.org/x/net=golang.org/x/net@v0.60.0 \
&& go mod edit -replace=golang.org/x/mod=golang.org/x/mod@v0.40.0 \
&& go mod edit -replace=google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
&& CGO_ENABLED=0 GOTOOLCHAIN=local go build -mod=mod -trimpath \
Expand All @@ -187,11 +200,17 @@ RUN archive=/tmp/gh.tar.gz \
# vulnerable Go modules did not resolve the reviewed replacements.
FROM gh-build AS go-tools-audit
RUN for binary in /out/*; do \
test "$(go version -m "$binary" | awk 'NR == 1 {print $2}')" = "go1.26.6" || exit 1; \
test "$(go version -m "$binary" | awk 'NR == 1 {print $2}')" = "go1.26.9" || exit 1; \
done \
&& for binary in /out/*; do \
go version -m "$binary" | awk \
'$1 == "dep" { pending = ($2 == "golang.org/x/net"); if (pending) version = $3; next } \
pending && $1 == "=>" { if ($2 != "golang.org/x/net") { bad = 1; exit }; version = $3; pending = 0 } \
END { if (bad) exit 1; if (version != "") exit (version != "v0.60.0") }' || exit 1; \
done \
&& for binary in /out/containerd /out/containerd-shim-runc-v2 /out/ctr /out/rootlesskit; do \
go version -m "$binary" | awk \
'$1 == "=>" && $2 == "golang.org/x/net" && $3 == "v0.56.0" { found = 1 } END { exit !found }' || exit 1; \
'$1 == "=>" && $2 == "golang.org/x/net" && $3 == "v0.60.0" { found = 1 } END { exit !found }' || exit 1; \
done \
&& for binary in /out/dockerd /out/containerd /out/rootlesskit /out/docker-buildx /out/docker-compose /out/gh; do \
go version -m "$binary" | awk \
Expand Down
Loading