cml-runner self-hosted issues

• ~/.cml/cml-*/ is not named according to --name
• ~/.cml/cml-*/ is not cleaned up on exit (should be cleaned esp. if no --name)
• don’t pass sensitive env vars (#802)
• cache runner setup script in ~/.cml/ (#615)
• feature request: local secrets (cml runner --env flag similar to docker run --env)
• feature request: user ID (cml runner --user flag similar to docker run --user)
• feature request: auto-mount sockets for docker-in-docker support (#799)

[DavidGOrtega]

There is not a lot of work to do here. As we discussed the GH runner has the “ability” to propagate its ENV vars. Here GH runner inherits the CML wrapper vars. What we should do to fix this and not allow the GH runner to behave this way is simply pass an empty ENV vars in the exec. This way the ENV vars that will always access the runner will be the CI vars and workflow.

[casperdcl]

just realised this is also a problem on all runners (not just manual self-hosted)

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
    - uses: iterative/setup-cml@v1
    - uses: actions/checkout@v2
    - run: |
        cml runner --labels=cml-runner --cloud=aws --cloud-type=t2.micro
      env:
        AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
        AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
        REPO_TOKEN: ${{ secrets.CML_CI_TOKEN }}
  train:
    runs-on: [self-hosted, cml-runner]
    steps:
    - run: env # why does this list AWS_ACCESS_KEY_ID & AWS_SECRET_ACCESS_KEY ??

should really either

• whitelist-only vanilla CI vars (GITHUB_ENV etc) or
• at least blacklist CML config vars (AWS_*ACCESS_KEY etc)