Docker latest tag is deprecated and is being removed entirely

[toast-gear]

We are deprecating the latest tag and subsequently removing it from DockerHub. Please adjust your environment to use the OS specific latest image.

Rationale
We are introducing a second runner image based on 22.04. This creates maintaining a latest tag difficult as it means having to switch over OS versions at essentially a random time potentially breaking users environments. Instead we will maintain a latest image on a per OS basis so end users can switch over to the newer image in their own time in a controlled manner.

[gthomson31]

Is it possible to update the version of Node in the Base image - Snyk flagging up vulnerabilities in current base

[kevholmes]

@gthomson31 Node.js isn't included in the base image by default, or are you referring to what's packaged with Ubuntu 20/22? Our team is using https://github.com/actions/setup-node to install whatever version is required by a workflow at exec time. That Action works in the rootless dind image, also.

[gthomson31]

Yeah think it must be Ubuntu that its complaining about - its a strange error as even on investigating the image I couldn't see any mention of Node either so not sure why snyk scanning throws this up.

[toast-gear]

It comes from the actions/runner software, you'd need to raise an issue in that repository

[evandam]

Hey @toast-gear, I'm just curious what this means for RunnerDeployment defaults? If the latest tag is being deprecated, what will the default value be for spec.template.spec.image? Curious if it will be updated to ubuntu-22.04 or even something like ubuntu-latest which mimics GitHub's runs-on convention, or will just be a required field with no default.

[pimguilherme]

Hi! We are using this image: summerwind/actions-runner:ubuntu-20.04

But it yields this warning when we execute the runner:

2023-02-03 16:37:43.817  NOTICE --- WARNING LATEST TAG HAS BEEN DEPRECATED. SEE GITHUB ISSUE FOR DETAILS:
2023-02-03 16:37:43.818  NOTICE --- https://github.com/actions/actions-runner-controller/issues/2056

Is thisa as expected? This is not the 'latest' tag, but I suppose it's the latest runner software for ubuntu-20.04, so that we don't have to auto update it every time it boots.. but I am not sure this is a problem

Thanks!

[DoNotResuscitate]

@pimguilherme I am using image: ghcr.io/actions/actions-runner-controller/actions-runner:ubuntu-20.04 and don't have the message

[pimguilherme]

thanks for the tip @DoNotResuscitate !

we are using summerwind/actions-runner:ubuntu-20.04.. is ghcr.io/actions/actions-runner-controller/actions-runner:ubuntu-20.04 the recommended image?

this is the pod config basically:

apiVersion: v1
kind: Pod
...
spec:
  containers:
  - env:
    
    ...
    image: summerwind/actions-runner:ubuntu-20.04
    imagePullPolicy: Always
    name: runner
    ...
  - env:
    - name: DOCKER_TLS_CERTDIR
      value: /certs
    ...
    image: docker:dind
    imagePullPolicy: IfNotPresent
    name: docker:dind
    ...

thanks!

[psi]

@pimguilherme fwiw, it looks like this notice gets logged without any conditional check, so it seems like it's expected behavior to me: https://github.com/actions/actions-runner-controller/blob/master/runner/startup.sh#L176-L177

(I just noticed this warning after upgrading as well and did a little digging on it)

[racker7]

@pimguilherme you asked the difference.
fwiw it looks like the Github Packages version is slightly older than the Dockerhub one. But it might be worth it in order to not deal with the Docker rate limiting. 2 months is not super old.

docker.io/summerwind/actions-runner                        ubuntu-22.04        4babb0d76d41        9 days ago          793 MB
ghcr.io/actions/actions-runner-controller/actions-runner   ubuntu-22.04        348d0f7e3e1a        2 months ago        783 MB

[pimguilherme]

@pimguilherme you asked the difference. fwiw it looks like the Github Packages version is slightly older than the Dockerhub one. But it might be worth it in order to not deal with the Docker rate limiting. 2 months is not super old.

docker.io/summerwind/actions-runner                        ubuntu-22.04        4babb0d76d41        9 days ago          793 MB
ghcr.io/actions/actions-runner-controller/actions-runner   ubuntu-22.04        348d0f7e3e1a        2 months ago        783 MB

thanks @racker7 ! that is indeed an interesting tradeoff :)

[Nuru]

@toast-gear Please clear up a few things.

Where is it documented that you can/should use the GHCR repo for images, and what tags you should use? I expected to find it in the README but I didn't find it there or in the docs.

Which is the right URL to view the action-runner and action-runner-dind tags? https://github.com/actions/actions-runner-controller has a "Packages" link that goes to https://github.com/orgs/actions/packages?repo_name=actions-runner-controller that has an entry "actions-runner" that goes to https://github.com/actions/actions-runner-controller/pkgs/container/actions-runner-controller%2Factions-runner that has an outdated list of tags. The latest one is v2.299.1.

Note that all of the above URLs are under the "actions" org. If I go to https://github.com/actions-runner-controller/actions-runner-controller (under the "actions-runner-controller" org) I get redirected to https://github.com/actions/actions-runner-controller (the "actions" org).

However, if I go directly to https://github.com/actions-runner-controller/actions-runner-controller/pkgs/container/actions-runner-controller%2Factions-runner I see the latest tag isv2.303.0, which is the same latest tag I see at https://hub.docker.com/r/summerwind/actions-runner/tags

I don't know why there are 2 GHCR package orgs or why the latest runner images are published under the old org ("actions-runner-controller", which redirects to "actions"). It is very confusing and it makes the right image hard to find.

I also don't know where to find the source or release notes for actions-runner anymore. Where is that?

[elocke]

oh damn I just ran into that @Nuru super confusing

[TPXP]

Came here from the warning in the logs of my action runners. I've found the warning is shown on all images, as the code does not check if we're using the latest image or not

actions-runner-controller/runner/startup.sh

Line 176 in d134dee

log.notice "WARNING LATEST TAG HAS BEEN DEPRECATED. SEE GITHUB ISSUE FOR DETAILS:"

This is quite confusing since the warning is shown in capital letters as if it was super important (and it catches attention), whereas the issue is already solved if I've configured my runners to use a given distro image for example.

Could we find a way to hide this warning on non-latest images? Making a small variation in the latest image seems reasonable to me, here are some PRs to do this:

• fix(startup): only show the "using latest tag" warning on relevant images #2718
• fix(runners): set SHOW_LATEST_TAG_WARN env var on latest images only actions-runner-controller/releases#11

Regarding images to use, after finding the build pipeline, I'm happy to confirm images are published to GHCR and the docker hub, here are links to their repos

• Docker Hub:
  • https://hub.docker.com/r/summerwind/actions-runner
  • https://hub.docker.com/r/summerwind/actions-runner-controller
  • https://hub.docker.com/r/summerwind/actions-runner-dind
  • https://hub.docker.com/r/summerwind/actions-runner-dind-rootless
• Github Actions Container Registry (the packages list seems super confused, use the ghcr.io redirect to view the latest images):
  • https://ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner
  • https://ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-controller
  • https://ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-dind
  • https://ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-dind-rootless

[Nuru]

@TPXP Thanks for the list.

Currently, https://ghcr.io/actions-runner-controller/actions-runner-controller/actions-runner-controller does not work. For some reason, it redirects to:

https://github.com/-/actions-runner-controller/packages/container/package/actions-runner-controller%2Factions-runner-controller

which does not exist. It appears the correct URL for actions-runner-controller is

https://ghcr.io/actions-runner-controller/actions-runner-controller

[evandam]

@toast-gear I was just wondering if there was any update on this?

It still seems unclear which images we're supposed to use.

[pecigonzalo]

Furthermore, the chart docs point also to the wrong images in them. https://github.com/actions/actions-runner-controller/blob/master/charts/gha-runner-scale-set/values.yaml#L123

[Nuru]

Furthermore, the chart docs point also to the wrong images in them. https://github.com/actions/actions-runner-controller/blob/master/charts/gha-runner-scale-set/values.yaml#L123

@pecigonzalo That's a different chart for a different runner, so naturally it points to a different image.

The project has split into GitHub-supported gha-runner-scale-set and gha-runner-scale-set-controller, and the legacy Summwerwind actions-runner-controller and actions-runner which references the summerwind/action-runner:latest.

Of course, @toast-gear, this only further confuses things, not only because we now have to keep track of two separate but closely linked and similarly named projects, but because the official chart uses the "latest" tag which you say is deprecated.

[pecigonzalo]

That's a different chart for a different runner, so naturally it points to a different image.

@Nuru I don't think that is that obvious or natural given the comments here, and the image could have been compatible with both versions as well. I actually would have expected that to be the case, that both charts use the same images with different flags. Given the unclear docs, it was a bit hard to find the right Dockerfile and image to verify.