[{"data":1,"prerenderedAt":598},["ShallowReactive",2],{"navigation":3,"\u002Freference\u002Frunner-configuration":194,"\u002Freference\u002Frunner-configuration-surround":594},[4,18,31,64,81,102,111,132,149],{"title":5,"path":6,"stem":7,"children":8,"page":17},"Getting started","\u002Fgetting-started","1.getting-started",[9,13],{"title":10,"path":11,"stem":12},"Introduction","\u002Fgetting-started\u002Fintroduction","1.getting-started\u002F1.introduction",{"title":14,"path":15,"stem":16},"Run your first workflow","\u002Fgetting-started\u002Fquickstart","1.getting-started\u002F2.quickstart",false,{"title":19,"path":20,"stem":21,"children":22,"page":17},"Core concepts","\u002Fconcepts","2.concepts",[23,27],{"title":24,"path":25,"stem":26},"The platform model","\u002Fconcepts\u002Fplatform","2.concepts\u002F1.platform",{"title":28,"path":29,"stem":30},"Architecture and boundaries","\u002Fconcepts\u002Farchitecture","2.concepts\u002F2.architecture",{"title":32,"path":33,"stem":34,"children":35,"page":17},"Installation","\u002Finstallation","3.installation",[36,40,44,48,52,56,60],{"title":37,"path":38,"stem":39},"Overview and requirements","\u002Finstallation\u002Foverview","3.installation\u002F1.overview",{"title":41,"path":42,"stem":43},"Local evaluation","\u002Finstallation\u002Flocal-evaluation","3.installation\u002F2.local-evaluation",{"title":45,"path":46,"stem":47},"Install the server","\u002Finstallation\u002Fserver","3.installation\u002F3.server",{"title":49,"path":50,"stem":51},"Install a runner","\u002Finstallation\u002Frunner","3.installation\u002F4.runner",{"title":53,"path":54,"stem":55},"Verify the installation","\u002Finstallation\u002Fverification","3.installation\u002F5.verification",{"title":57,"path":58,"stem":59},"Upgrade the platform","\u002Finstallation\u002Fupgrades","3.installation\u002F6.upgrades",{"title":61,"path":62,"stem":63},"Guided installer","\u002Finstallation\u002Finstaller","3.installation\u002F7.installer",{"title":65,"path":66,"stem":67,"children":68,"page":17},"Build workflows","\u002Fworkflows","4.workflows",[69,73,77],{"title":70,"path":71,"stem":72},"Build a Definition","\u002Fworkflows\u002Fdefinitions","4.workflows\u002F0.definitions",{"title":74,"path":75,"stem":76},"Deploy and run workflows","\u002Fworkflows\u002Fruns","4.workflows\u002F1.runs",{"title":78,"path":79,"stem":80},"Inputs, context, and secrets","\u002Fworkflows\u002Finputs-and-secrets","4.workflows\u002F2.inputs-and-secrets",{"title":82,"path":83,"stem":84,"children":85,"page":17},"Run and recover","\u002Foperations","5.operations",[86,90,94,98],{"title":87,"path":88,"stem":89},"Monitor Runs","\u002Foperations\u002Fmonitoring","5.operations\u002F1.monitoring",{"title":91,"path":92,"stem":93},"Approve prepared steps","\u002Foperations\u002Fapprovals","5.operations\u002F2.approvals",{"title":95,"path":96,"stem":97},"Recover or cancel execution","\u002Foperations\u002Frecovery","5.operations\u002F3.recovery",{"title":99,"path":100,"stem":101},"Troubleshooting","\u002Foperations\u002Ftroubleshooting","5.operations\u002F4.troubleshooting",{"title":103,"path":104,"stem":105,"children":106,"page":17},"Action catalog","\u002Fcatalog","6.catalog",[107],{"title":108,"path":109,"stem":110},"Find and use Actions","\u002Fcatalog\u002Foverview","6.catalog\u002F1.overview",{"title":112,"path":113,"stem":114,"children":115,"page":17},"Administration","\u002Fadministration","7.administration",[116,120,124,128],{"title":117,"path":118,"stem":119},"Registries and Environments","\u002Fadministration\u002Fenvironments","7.administration\u002F2.environments",{"title":121,"path":122,"stem":123},"Manage runners","\u002Fadministration\u002Frunners","7.administration\u002F3.runners",{"title":125,"path":126,"stem":127},"Access and approval policies","\u002Fadministration\u002Faccess","7.administration\u002F4.access",{"title":129,"path":130,"stem":131},"Backups and upgrades","\u002Fadministration\u002Fmaintenance","7.administration\u002F5.maintenance",{"title":133,"path":134,"stem":135,"children":136,"page":17},"Develop Actions","\u002Factions","8.actions",[137,141,145],{"title":138,"path":139,"stem":140},"Build your first Action","\u002Factions\u002Fquickstart","8.actions\u002F1.quickstart",{"title":142,"path":143,"stem":144},"Local development","\u002Factions\u002Flocal-development","8.actions\u002F2.local-development",{"title":146,"path":147,"stem":148},"Publish an Action","\u002Factions\u002Fpublishing","8.actions\u002F3.publishing",{"title":150,"path":151,"stem":152,"children":153,"page":17},"Reference","\u002Freference","9.reference",[154,158,162,166,170,174,178,182,186,190],{"title":155,"path":156,"stem":157},"Operator CLI","\u002Freference\u002Foperator-cli","9.reference\u002F1.operator-cli",{"title":159,"path":160,"stem":161},"Installer CLI","\u002Freference\u002Finstaller-cli","9.reference\u002F10.installer-cli",{"title":163,"path":164,"stem":165},"Definition syntax","\u002Freference\u002Fdefinition","9.reference\u002F2.definition",{"title":167,"path":168,"stem":169},"CLI configuration","\u002Freference\u002Fconfiguration","9.reference\u002F3.configuration",{"title":171,"path":172,"stem":173},"API integration","\u002Freference\u002Fapi","9.reference\u002F4.api",{"title":175,"path":176,"stem":177},"Action CLI","\u002Freference\u002Faction-cli","9.reference\u002F5.action-cli",{"title":179,"path":180,"stem":181},"Action SDK","\u002Freference\u002Fsdk","9.reference\u002F6.sdk",{"title":183,"path":184,"stem":185},"Contracts and compatibility","\u002Freference\u002Fcontracts","9.reference\u002F7.contracts",{"title":187,"path":188,"stem":189},"Server configuration","\u002Freference\u002Fserver-configuration","9.reference\u002F8.server-configuration",{"title":191,"path":192,"stem":193},"Runner configuration","\u002Freference\u002Frunner-configuration","9.reference\u002F9.runner-configuration",{"id":195,"title":191,"body":196,"description":588,"extension":589,"meta":590,"navigation":591,"path":192,"seo":592,"stem":193,"__hash__":593},"docs\u002F9.reference\u002F9.runner-configuration.md",{"type":197,"value":198,"toc":581},"minimark",[199,207,212,324,334,341,345,402,410,420,431,449,453,468,474,481,495,499,505,519,525,540,544,574,577],[200,201,202,203,206],"p",{},"For complete container and Linux service examples, see ",[204,205,49],"a",{"href":50},". The runner takes command-line flags and environment variables; it does not load a runner YAML configuration file.",[208,209,211],"h2",{"id":210},"start-flags","Start flags",[213,214,215,231],"table",{},[216,217,218],"thead",{},[219,220,221,225,228],"tr",{},[222,223,224],"th",{},"Flag",[222,226,227],{},"Default",[222,229,230],{},"Meaning",[232,233,234,251,266,279,294,309],"tbody",{},[219,235,236,243,248],{},[237,238,239],"td",{},[240,241,242],"code",{},"--server",[237,244,245],{},[240,246,247],{},"PYPLINES_SERVER",[237,249,250],{},"Required HTTPS server origin, including port if needed",[219,252,253,258,263],{},[237,254,255],{},[240,256,257],{},"--enrollment-token-file",[237,259,260],{},[240,261,262],{},"PYPLINES_ENROLLMENT_TOKEN_FILE",[237,264,265],{},"Enrollment credential file, required until registration is saved",[219,267,268,273,276],{},[237,269,270],{},[240,271,272],{},"--name",[237,274,275],{},"Empty",[237,277,278],{},"Optional display name submitted during registration",[219,280,281,286,291],{},[237,282,283],{},[240,284,285],{},"--ca-file",[237,287,288],{},[240,289,290],{},"PYPLINES_CA_FILE",[237,292,293],{},"PEM CA bundle added to system trust for HTTPS and NATS",[219,295,296,301,306],{},[237,297,298],{},[240,299,300],{},"--max-concurrent",[237,302,303],{},[240,304,305],{},"1",[237,307,308],{},"Maximum workload-container concurrency, from 1 to 64",[219,310,311,316,321],{},[237,312,313],{},[240,314,315],{},"--ephemeral",[237,317,318],{},[240,319,320],{},"false",[237,322,323],{},"Retire the identity after successfully draining on shutdown",[200,325,326,327,329,330,333],{},"Explicit flags override their corresponding environment defaults. ",[240,328,242],{}," must be an HTTPS origin such as ",[240,331,332],{},"https:\u002F\u002Fpyplines.example.com:8080",", without credentials, query parameters, fragments, or an API path prefix. Registration redirects are rejected.",[200,335,336,337,340],{},"The runner obtains the NATS address from the server after admission. There is no runner flag that overrides a misconfigured server ",[240,338,339],{},"--nats-url",". Both endpoints must be reachable and trusted. The runner does not serve an inbound management port.",[208,342,344],{"id":343},"state-and-work-environment-variables","State and work environment variables",[213,346,347,358],{},[216,348,349],{},[219,350,351,354,356],{},[222,352,353],{},"Variable",[222,355,227],{},[222,357,230],{},[232,359,360,375,390],{},[219,361,362,367,372],{},[237,363,364],{},[240,365,366],{},"PYPLINES_RUNNER_STATE",[237,368,369],{},[240,370,371],{},"\u002Fvar\u002Flib\u002Fpyplines-runner",[237,373,374],{},"Persistent identity and invocation work directory visible to the runner",[219,376,377,382,387],{},[237,378,379],{},[240,380,381],{},"PYPLINES_WORK_VOLUME",[237,383,384],{},[240,385,386],{},"pyplines-work",[237,388,389],{},"Docker named volume from which Action input\u002Foutput subdirectories are mounted",[219,391,392,397,399],{},[237,393,394],{},[240,395,396],{},"PYPLINES_ACTION_NETWORK",[237,398,275],{},[237,400,401],{},"Docker network permitted for Actions that require network access",[200,403,404,405,409],{},"These are separate settings with a required relationship: the state directory and work volume must expose ",[406,407,408],"strong",{},"the same files",". In a container, mount the named work volume at the state path. For a native Linux process, create a Docker local-driver volume backed by that host directory, as shown in the installation guide.",[200,411,412,413,419],{},"Actions mount only their invocation's input\u002Foutput subdirectories, not the whole runner state. Docker must support named-volume subdirectory mounts; see ",[204,414,418],{"href":415,"rel":416},"https:\u002F\u002Fdocs.docker.com\u002Fengine\u002Fstorage\u002Fvolumes\u002F#mount-a-volume-subdirectory",[417],"nofollow","Docker volume documentation",".",[200,421,422,423,426,427,430],{},"The work directory includes ",[240,424,425],{},"identity.json",", its private authentication material, ",[240,428,429],{},"runner.lock",", and invocation directories. Keep it private and persistent. A filesystem lock prevents two processes from owning the same state directory. Do not clone an identity into another active runner or delete it to recover unfinished work.",[200,432,433,434,437,438,441,442,445,446,448],{},"Use a distinct work volume for each runner on a host. For the native service, ",[240,435,436],{},"UMask=0022"," preserves read access to ordinary staged inputs for Action UID ",[240,439,440],{},"65532","; identity files are explicitly written as ",[240,443,444],{},"0600",". The runner must be able to assign output ownership to UID\u002FGID ",[240,447,440],{},", which is why the documented service runs as root.",[208,450,452],{"id":451},"docker-and-registry-access","Docker and registry access",[200,454,455,456,459,460,463,464,467],{},"The runner uses its provisioned Docker client environment, including ",[240,457,458],{},"DOCKER_HOST"," and Docker TLS settings when configured. It does ",[406,461,462],{},"not"," select a saved interactive Docker context. The documented setup explicitly uses ",[240,465,466],{},"DOCKER_HOST=unix:\u002F\u002F\u002Fvar\u002Frun\u002Fdocker.sock"," on the local host.",[200,469,470,471,473],{},"The runner must see the filesystem used by its Docker work volume. Pointing ",[240,472,458],{}," at a different machine does not transfer staged input\u002Foutput files and is not the deployment pattern covered here.",[200,475,476,477,480],{},"Docker socket access grants control over that daemon. It belongs to the runner service, not to the server or workload containers. Action image read credentials are delivered through the platform's registry configuration; a host ",[240,478,479],{},"docker login"," used to pull the runner image is a separate concern.",[200,482,483,484,487,488,490,491,494],{},"For a network-enabled Action, the Environment's ",[240,485,486],{},"network"," must equal ",[240,489,396],{},", and the network must exist on the selected runner's Docker host. Actions that do not require networking run with network mode ",[240,492,493],{},"none",". Do not use a network name that exists only on another host.",[208,496,498],{"id":497},"enrollment-and-restart","Enrollment and restart",[200,500,501,502,504],{},"Before registration completes, the runner needs the enrollment file and persists enough local identity to retry an interrupted registration. Once ",[240,503,425],{}," contains the registered runner ID, restarts reuse it and no longer read the enrollment token. The configured server origin must match the saved origin.",[200,506,507,508,511,512,515,516,419],{},"Admission is an administrator decision. A process waiting for approval is not yet execution capacity. After approval, inspect ",[240,509,510],{},"last_seen",", admission, pool, and draining status with ",[240,513,514],{},"pyplines --json runner list",", then run the ",[204,517,518],{"href":54},"verification workflow",[200,520,521,522,524],{},"SIGTERM\u002FSIGINT stops acceptance of new work and starts a bounded reconciliation window of about 30 seconds. If it expires, state remains for later reconciliation; shutdown does not prove every external effect has settled. ",[240,523,315],{}," retirement occurs only once draining and reconciliation complete.",[200,526,527,528,531,532,535,536,539],{},"An administrative drain persists on the server. The current server has no resume transition; restarting the process does not undo that drain. The installation examples use ",[240,529,530],{},"Restart=on-failure","\u002F",[240,533,534],{},"restart: on-failure"," so a clean drain exit is respected. See ",[204,537,538],{"href":122},"runner management"," before replacing identities.",[208,541,543],{"id":542},"inspect-an-installed-runner","Inspect an installed runner",[545,546,552],"pre",{"className":547,"code":548,"filename":549,"language":550,"meta":551,"style":551},"language-sh shiki shiki-themes pyplines-light pyplines-light pyplines-dark","pyplines-runner version\npyplines-runner start --help\npyplines --json runner list\n","Terminal","sh","",[240,553,554,562,568],{"__ignoreMap":551},[555,556,559],"span",{"class":557,"line":558},"line",1,[555,560,561],{},"pyplines-runner version\n",[555,563,565],{"class":557,"line":564},2,[555,566,567],{},"pyplines-runner start --help\n",[555,569,571],{"class":557,"line":570},3,[555,572,573],{},"pyplines --json runner list\n",[200,575,576],{},"There is no runner HTTP health endpoint. Use service\u002Fcontainer status, runner logs, advancing heartbeats, and a successful test Run together. After a server restart, allow runners to reestablish transport and report their state before treating them as available.",[578,579,580],"style",{},"html .light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html.light .shiki span {color: var(--shiki-light);background: var(--shiki-light-bg);font-style: var(--shiki-light-font-style);font-weight: var(--shiki-light-font-weight);text-decoration: var(--shiki-light-text-decoration);}html .default .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .shiki span {color: var(--shiki-default);background: var(--shiki-default-bg);font-style: var(--shiki-default-font-style);font-weight: var(--shiki-default-font-weight);text-decoration: var(--shiki-default-text-decoration);}html .dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}html.dark .shiki span {color: var(--shiki-dark);background: var(--shiki-dark-bg);font-style: var(--shiki-dark-font-style);font-weight: var(--shiki-dark-font-weight);text-decoration: var(--shiki-dark-text-decoration);}",{"title":551,"searchDepth":564,"depth":564,"links":582},[583,584,585,586,587],{"id":210,"depth":564,"text":211},{"id":343,"depth":564,"text":344},{"id":451,"depth":564,"text":452},{"id":497,"depth":564,"text":498},{"id":542,"depth":564,"text":543},"Enrollment, persistent state, Docker, networks, and lifecycle settings for pyplines-runner.","md",{},true,{"title":191,"description":588},"Gm16PO4hycjRy-1VDAFvwR8slDD_I-9H5AtLPYHmxUY",[595,597],{"title":187,"path":188,"stem":189,"description":596,"children":-1},"Commands, flags, TLS, storage, and lifecycle settings for pyplines-server.",null,1792213698066]