Skip to content

Conversation

OliviaShoup
Copy link
Contributor

What does this PR do? What is the motivation?

This PR adds a new page for the Private Action Runner (PAR) script action.

Merge instructions

Merge readiness:

  • Ready for merge

@OliviaShoup OliviaShoup added the under_review Sent to someone outside of the docs team for review. label Aug 20, 2025
@github-actions github-actions bot added the Architecture Everything related to the Doc backend label Aug 20, 2025
Copy link
Contributor

github-actions bot commented Aug 20, 2025

ℹ️ Documentation Team Review

No documentation team review is required for this pull request.

Copy link
Contributor

github-actions bot commented Aug 20, 2025

Comment on lines +43 to +57
### 1. Update your runner image

Replace the standard PAR image with the development image that supports script actions. The development images are published on [Docker Hub][2].

**Standard image:**
```
gcr.io/datadoghq/private-action-runner:v1.3.0
```

**Script-enabled image:**
```
datadog/private-action-runner-dev:latest@sha256:4e990e496b79d02514c19a633042d27be1ba8e7a4b9018efd0e942ed1a070ad8
```

You can either reuse an existing runner's identity by changing the image, or create a brand new runner.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are specific to the preview phase PAR Version**: 1.7.0 or later should be sufficient

OliviaShoup and others added 17 commits August 28, 2025 13:44
To use the script action, you need:

- **Custom tools**: For CLI tools not included in the base image, you need to create a custom Docker image.
- **PAR Version**: 1.7.0 or later. See [set up a private action runner][2] to get started.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this dynamic ? The version is 1.7.0 but we bump it regularly


### 3. Configure the action catalog

You can find the "Run Predefined Script" action marked as "experimental" in the action catalog. This action is available for use in both workflows and apps.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This action is not "experimental" anymore as it has been released.

command: [ "bash", "/etc/dd-action-runner-script/scripts/script.sh" ]
```

## Updating the PAR
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think we should have a dedicated page for this section no ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good question! I've been thinking about this but I'm still not sure. @dd-gplassard do you have an opinion on this?

Copy link
Contributor

@dd-gplassard dd-gplassard Sep 4, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes agreed, I think a dedicated page would be a good thing


<!-- ADD INFO? -->

To view the latest version of the PAR, check [this URL][6].
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is it possible that we display the latest version in the doc dynamically by fetching the response of this URL ?


To check the PAR logs:
```bash
docker logs <id-of-container>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@dd-gplassard do you think it's better in the example to create the containers with --name datadog-private-actions-runner and then use that name downstream instead of <id-of-container> ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately I think this would be annoying because it would create conflicts when trying to rerun the command
image

- "9016:9016"
volumes:
- "./config:/etc/dd-action-runner"
user: "0"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

same here: we might need to remove this user as it would run as root

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes most up to date is

services:
  runner:
    image: gcr.io/datadoghq/private-action-runner:v1.7.0
    cpus: 25
    mem_limit: 1g
    deploy:
      replicas: 1
    environment:
      - DD_BASE_URL=https://app.datadoghq.com
      - DD_PRIVATE_RUNNER_CONFIG_DIR=/etc/dd-action-runner/config 
      - RUNNER_ENROLLMENT_TOKEN=<the_token>
      - STATSD_ENABLED=true
    volumes:
      - "./config:/etc/dd-action-runner/config"

### Helm mode
When using Helm, there are two options for upgrading the PAR:
1. **(Recommended)** Upgrade the chart, which will use the latest version of the PAR. There may be changes to the chart; please review [our changelog][8].
1. Upgrade the runner without upgrading the chart.
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
1. Upgrade the runner without upgrading the chart.
2. Upgrade the runner without upgrading the chart.


```bash
helm repo update
helm upgrade <RELEASE_NAME> datadog/private-action-runner -f ./values.yaml
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should say <RELEASE_NAME> is the release name they used when creating the runner. But I believe here it will make it easier if this Upgrade section is closed to the Create section so users keep stay in the same context.

Comment on lines +101 to +102
FROM gcr.io/datadoghq/private-action-runner:v1.7.0
RUN apt update && apt install -y python3
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
FROM gcr.io/datadoghq/private-action-runner:v1.7.0
RUN apt update && apt install -y python3
FROM gcr.io/datadoghq/private-action-runner:v1.7.0
USER root
RUN apt update && apt install -y python3
USER dog

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I thought end user is scriptuser ?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is the default user the runner will be running as

root -> install dependencies
dog -> runs the runner (read + write permission on the runner config)
scriptuser -> the runner sus as scriptuser (no permissions on the runner config)


Run:
```bash
docker run -d -u 0 --platform=linux/x86_64 -p 9016:9016 -v ./config:/etc/dd-action-runner --health-cmd "curl http://localhost:9016/liveness" --health-interval 10s --health-timeout 10s --health-retries 3 gcr.io/datadoghq/private-action-runner:v1.0.0
Copy link
Contributor

@dd-gplassard dd-gplassard Sep 2, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes we recently updated the flag so we should no longer use --platform and --user (and added --cpus and --memory) maybe we should put the exact command inside the app on the runner's edit page ? This way we can keep them in sync more easily ? But maybe we can start with the doc like this for now

The latest command should be

docker run -d \
 --cpus="0.25" \
 --memory="1g"  \
 -e DD_PRIVATE_RUNNER_CONFIG_DIR=/etc/dd-action-runner/config 
 -v ./config:/etc/dd-action-runner/config \
 --health-cmd "curl http://localhost:9016/liveness" \
 --health-interval 10s \
 --health-timeout 10s \
 --health-retries 3 gcr.io/datadoghq/private-action-runner:v1.7.0

(essentially what this displays but removing all env variables except the config dir one )


To check the PAR logs:
```bash
docker logs <id-of-container>
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Unfortunately I think this would be annoying because it would create conflicts when trying to rerun the command
image

- "9016:9016"
volumes:
- "./config:/etc/dd-action-runner"
user: "0"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

yes most up to date is

services:
  runner:
    image: gcr.io/datadoghq/private-action-runner:v1.7.0
    cpus: 25
    mem_limit: 1g
    deploy:
      replicas: 1
    environment:
      - DD_BASE_URL=https://app.datadoghq.com
      - DD_PRIVATE_RUNNER_CONFIG_DIR=/etc/dd-action-runner/config 
      - RUNNER_ENROLLMENT_TOKEN=<the_token>
      - STATSD_ENABLED=true
    volumes:
      - "./config:/etc/dd-action-runner/config"

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Architecture Everything related to the Doc backend under_review Sent to someone outside of the docs team for review.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants