GitLab Runner访问其他用户目录权限问题及最优方案咨询

环境背景 #

• 运行环境：Raspberry Pi，主用户为lukas
• 已在设备上配置gitlab-runner并关联目标代码仓库，流水线通过shell executor执行

系统/home目录下的用户情况：

lukas@raspberrypi:/ $ ls
bin   dev  home        initrd.img.old  lost+found  mnt  proc  run   srv  tmp  var      vmlinuz.old
boot  etc  initrd.img  lib             media       opt  root  sbin  sys  usr  vmlinuz
lukas@raspberrypi:/ $ cd home
lukas@raspberrypi:/home $ ls
gitlab-runner  lukas

流水线配置 #

尝试的测试流水线配置：

# List of stages for jobs, and their order of execution
stages:
  - test

test-job1:
  stage: test
  tags:
    - raspberrypi
  script:
    - echo "This job tests something"
    - cd /home/lukas/Scripts
    - ls -l

执行错误 #

运行流水线时出现权限拒绝错误：

Running with gitlab-runner 16.7.0 (102c81ba)
  on Raspberry PI TestTool runner htiDWYJ2, system ID: s_0ae6b2582ae5
Preparing the "shell" executor
00:00
Using Shell (bash) executor...
Preparing environment
00:00
Running on raspberrypi...
Getting source from Git repository
00:05
Fetching changes with git depth set to 20...
Reinitialized existing Git repository in /home/gitlab-runner/builds/htiDWYJ2/0/embeded-programmers/gitchangelog-test/.git/
Checking out 0f2827a6 as detached HEAD (ref is main)...
Skipping Git submodules setup
Executing "step_script" stage of the job script
00:00
$ echo "This job tests something"
This job tests something
$ cd /home/lukas/Scripts
bash: line 149: cd: /home/lukas/Scripts: Permission denied
Cleaning up project directory and file based variables
00:00
ERROR: Job failed: exit status 1

原因是gitlab-runner以独立的gitlab-runner用户运行，无lukas用户目录的访问权限。

已尝试的方法 #

• 方法1：将脚本移动到/tmp目录，gitlab-runner可正常访问，但此方案不符合需求，不考虑。
• 方法2：为gitlab-runner用户添加sudo权限：
  执行命令：sudo usermod -a -G sudo gitlab-runner
  在/etc/sudoers中添加：gitlab-runner ALL=(ALL) NOPASSWD:ALL
  重新运行作业后仍出现权限问题，失败。
• 方法3：通过sudo cp -r /home/lukas/Scripts /home/gitlab-runner将脚本复制到gitlab-runner用户目录，gitlab-runner可正常访问。询问此方法是否安全，是否适用于生产环境？
• 方法4：修改Scripts目录所有权：sudo chown gitlab-runner:gitlab-runner /home/lukas/Scripts，修改后目录权限如下：

lukas@raspberrypi:~ $ ls -l
total 44
drwxr-xr-x 2 lukas         lukas         4096 Dec  5 04:47 Bookshelf
drwxr-xr-x 2 lukas         lukas         4096 Jan  9 09:26 Desktop
drwxr-xr-x 2 lukas         lukas         4096 Jan  2 07:30 Documents
drwxr-xr-x 2 lukas         lukas         4096 Jan  3 05:45 Downloads
drwxr-xr-x 2 lukas         lukas         4096 Jan  2 07:30 Music
drwxr-xr-x 2 lukas         lukas         4096 Jan  2 07:30 Pictures
drwxr-xr-x 2 lukas         lukas         4096 Jan  2 07:30 Public
drwxr-xr-x 2 gitlab-runner gitlab-runner 4096 Jan  9 09:36 Scripts
drwxr-xr-x 2 lukas         lukas         4096 Jan  2 07:30 Templates
drwxr-xr-x 9 lukas         lukas         4096 Jan  9 09:11 test-tool-binaries
drwxr-xr-x 2 lukas         lukas         4096 Jan  2 07:30 Videos

重新运行作业后仍出现权限问题，失败。

问题 #

请问哪种方法最为合适？

内容的提问来源于stack exchange，提问作者TheBestPlayer