Azure
[Bug/Feature] persistent self hosted runner -> multiple runners on one persistent host
Hi dear Azure/login action team,
maybe I am wrong, but I think there is an issue when you have multiple self hosted runners on one persistent host.
Following scenario:
- Azure Linux VM (persistent) with one user
- multiple runners registered (Github enterprise, but I am sure same should apply for Github.com) onto this one VM with same user (started service
svc.sh) - using this github action for login
If I get it right, then the login will write authentication information (tokens,..) into ˜/.azure/.. Due to the fact that we have multiple runners on this one single host registered with the same user, one runner will steal the authentication information for the other jobs.
If this is the case, then it is highly dangerous because one runner will run with the credentials of another runner.
Maybe I did not fully get this right and the login is related to the runner and not the user.
If I am right, it would be nice to have the login context related to the runner not the user or at least add a howto/warning if using self hosted runners. Best would be to have one login context per workflow job.
Hi @AndreasAugustin, you're right. Azure Login Action is not well-designed for self-hosted runners from the very beginning. Glad to see you‘re interested in mutil-runners in one host. You're correct about the user and login context. However, Azure Login Action relies on the underlying tools, which now do not support the use scenario. We're working on this but it'll take a long time to make it happen as I can see. Before that, let's mark this as a limitation of Azure Login Action.
Hi @YanaXu thanks for the verification. Just added a short documentation add on #397 with the hope to help others :heart:
@AndreasAugustin if you are using multiple runners on the same host (wouldn't recommend for several reasons) you should at least use different users for each of the runners (it's not only about az cli, using a single user (or the same $HOME to be more precise) also may lead to other concurrency issue with other tools)
Hi @tspascoal and thanks for the hint. Yes because of that I added a documentation addon into this repo some time ago #397 like mentioned above 🚀