Add resource limits and automated systemd service installation

- Add RUNNER_MEMORY_LIMIT and RUNNER_CPU_LIMIT to .env.runner.example
- Update deploy-runner.sh to apply resource limits when configured
- Create install-service.sh for automated systemd service installation
- Script auto-detects repository root and updates service paths
- Update README with resource limits configuration and automated install
- Address feedback: automate path replacement and add resource limits

Co-authored-by: arii <342438+arii@users.noreply.github.com>

Author: Copilot

deploy/runner/.env.runner.example

@@ -17,3 +17,11 @@ RUNNER_TOKEN=
 # Must have 'repo' scope (or 'public_repo' for public repositories)
 # Generate at: https://github.com/settings/tokens
 GITHUB_PAT=
+
+# Optional: Resource limits for the Docker container
+# Recommended for production deployments to prevent resource exhaustion
+# Memory limit (e.g., 2g for 2 gigabytes, 512m for 512 megabytes)
+RUNNER_MEMORY_LIMIT=
+
+# CPU limit (e.g., 2 for 2 CPUs, 0.5 for half a CPU)
+RUNNER_CPU_LIMIT=

deploy/runner/README.md

@@ -33,6 +33,8 @@ Edit `.env.runner` and set:
 - `REPO_URL`: The GitHub repository URL (required, default: `https://github.com/arii/hrm`)
 - `RUNNER_TOKEN`: Runner registration token (optional - auto-generated if not provided)
 - `GITHUB_PAT`: GitHub Personal Access Token (optional - only needed if `gh` CLI is not authenticated)
+- `RUNNER_MEMORY_LIMIT`: Memory limit for container (optional, e.g., `2g` for 2GB, recommended for production)
+- `RUNNER_CPU_LIMIT`: CPU limit for container (optional, e.g., `2` for 2 CPUs, recommended for production)
 
 #### Automatic Token Generation
 
@@ -89,7 +91,30 @@ Verify in GitHub:
 
 For automatic startup on system boot and better management, set up the systemd service.
 
-### Installation
+### Automated Installation (Recommended)
+
+Use the provided installation script to automatically configure paths:
+
+```bash
+sudo ./install-service.sh
+```
+
+This script will:
+1. Detect the repository root path automatically
+2. Update the service file with correct paths
+3. Install the service to `/etc/systemd/system/`
+4. Reload systemd daemon
+
+After installation:
+
+```bash
+sudo systemctl enable hrm-runner.service
+sudo systemctl start hrm-runner.service
+```
+
+### Manual Installation
+
+If you prefer manual installation:
 
 1. Edit `hrm-runner.service` and replace `/path/to/hrm` with the actual path to your repository:
 
@@ -288,7 +313,7 @@ cd /home/runner/actions-runner
 ### Important Security Limitations
 
 - **No Docker-in-Docker by default**: The container does not mount the Docker socket, so jobs that need to build Docker images will fail. If needed, add `-v /var/run/docker.sock:/var/run/docker.sock` to the docker run command, but be aware this grants significant privileges.
-- **Resource limits**: Consider adding `--memory` and `--cpus` flags to the docker run command to prevent resource exhaustion.
+- **Resource limits**: Configure `RUNNER_MEMORY_LIMIT` and `RUNNER_CPU_LIMIT` in `.env.runner` to prevent resource exhaustion. Recommended for production deployments (e.g., `RUNNER_MEMORY_LIMIT=2g` and `RUNNER_CPU_LIMIT=2`).
 - **Sudo access**: The runner user has sudo access (with password requirement). For maximum security, you may want to remove sudo access entirely if not needed by your workflows.
 - **GitHub PAT Storage**: If using `GITHUB_PAT` for automatic token generation, ensure `.env.runner` file permissions are restrictive (`chmod 600 .env.runner`).
 
@@ -325,9 +350,10 @@ cd /home/runner/actions-runner
 | ------------------------ | ------------------------------------------------- |
 | `Dockerfile.runner`      | Docker image definition for the runner            |
 | `entrypoint.sh`          | Container entrypoint - configures and starts runner |
-| `deploy-runner.sh`       | Deployment script - builds and runs the container, auto-generates token if needed |
-| `.env.runner.example`    | Configuration template with REPO_URL, RUNNER_TOKEN, and GITHUB_PAT |
-| `hrm-runner.service`     | Systemd service definition                        |
+| `deploy-runner.sh`       | Deployment script - builds and runs the container, auto-generates token if needed, applies resource limits |
+| `install-service.sh`     | Automated systemd service installation with path auto-detection |
+| `.env.runner.example`    | Configuration template with REPO_URL, RUNNER_TOKEN, GITHUB_PAT, and resource limits |
+| `hrm-runner.service`     | Systemd service definition (template)             |
 | `README.md`              | This documentation                                |
 
 ## Related Documentation

deploy/runner/deploy-runner.sh

@@ -142,11 +142,27 @@ fi
 
 # Run the container
 echo "Starting GitHub Actions Runner container..."
-docker run -d --restart unless-stopped \
-  --name hrm-runner \
-  -e REPO_URL="$REPO_URL" \
-  -e RUNNER_TOKEN="$RUNNER_TOKEN" \
-  hrm-actions-runner
+
+# Build docker run command with optional resource limits
+DOCKER_RUN_CMD="docker run -d --restart unless-stopped --name hrm-runner"
+
+# Add memory limit if specified
+if [ -n "$RUNNER_MEMORY_LIMIT" ]; then
+  echo "Setting memory limit: $RUNNER_MEMORY_LIMIT"
+  DOCKER_RUN_CMD="$DOCKER_RUN_CMD --memory=$RUNNER_MEMORY_LIMIT"
+fi
+
+# Add CPU limit if specified
+if [ -n "$RUNNER_CPU_LIMIT" ]; then
+  echo "Setting CPU limit: $RUNNER_CPU_LIMIT"
+  DOCKER_RUN_CMD="$DOCKER_RUN_CMD --cpus=$RUNNER_CPU_LIMIT"
+fi
+
+# Add environment variables and image
+DOCKER_RUN_CMD="$DOCKER_RUN_CMD -e REPO_URL=\"$REPO_URL\" -e RUNNER_TOKEN=\"$RUNNER_TOKEN\" hrm-actions-runner"
+
+# Execute the command
+eval $DOCKER_RUN_CMD
 
 echo ""
 echo "✓ GitHub Actions Runner deployed successfully!"

deploy/runner/install-service.sh

@@ -0,0 +1,67 @@
+#!/bin/bash
+
+# HRM GitHub Actions Runner - Systemd Service Installation Script
+# This script installs the hrm-runner.service systemd unit
+
+set -e
+
+# Change to the directory where this script is located
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+cd "$SCRIPT_DIR"
+
+# Detect the repository root (parent of deploy/runner)
+REPO_ROOT="$(cd "$SCRIPT_DIR/../.." && pwd)"
+
+echo "HRM GitHub Actions Runner - Systemd Service Installation"
+echo "========================================================="
+echo ""
+echo "Detected repository root: $REPO_ROOT"
+echo "Service working directory: $SCRIPT_DIR"
+echo ""
+
+# Check if running with appropriate permissions
+if [ "$EUID" -ne 0 ]; then 
+  echo "This script requires root privileges to install systemd services."
+  echo "Please run with sudo:"
+  echo "  sudo ./install-service.sh"
+  exit 1
+fi
+
+# Create a temporary service file with updated paths
+SERVICE_FILE="/tmp/hrm-runner.service.tmp"
+cp hrm-runner.service "$SERVICE_FILE"
+
+# Replace placeholder paths with actual paths
+sed -i "s|/path/to/hrm|$REPO_ROOT|g" "$SERVICE_FILE"
+
+echo "Generated service file:"
+echo "----------------------"
+cat "$SERVICE_FILE"
+echo "----------------------"
+echo ""
+
+# Confirm installation
+read -p "Install this service to /etc/systemd/system/hrm-runner.service? [y/N] " -n 1 -r
+echo
+if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+  echo "Installation cancelled."
+  rm "$SERVICE_FILE"
+  exit 0
+fi
+
+# Copy to systemd directory
+cp "$SERVICE_FILE" /etc/systemd/system/hrm-runner.service
+rm "$SERVICE_FILE"
+
+# Reload systemd
+echo "Reloading systemd daemon..."
+systemctl daemon-reload
+
+echo ""
+echo "✓ Service installed successfully!"
+echo ""
+echo "Next steps:"
+echo "  1. Enable service: sudo systemctl enable hrm-runner.service"
+echo "  2. Start service:  sudo systemctl start hrm-runner.service"
+echo "  3. Check status:   sudo systemctl status hrm-runner.service"
+echo "  4. View logs:      sudo journalctl -u hrm-runner.service -f"