runner-config.yaml

@@ -6,6 +6,10 @@ container:
   valid_volumes:
     - "/var/run/docker.sock"
   # appended to `docker run` when the runner spawns a job container
+  # SECURITY: Mounting the Docker socket grants job containers root-equivalent
+  # access to the host Docker daemon. Acceptable here because only trusted code
+  # from this private repo runs on this runner. Do NOT use on a runner that
+  # accepts untrusted PRs from external contributors.
   options: "-v /var/run/docker.sock:/var/run/docker.sock"
   # keep network mode default (bridge) — Testcontainers handles its own networking
   force_pull: false