Run commands in your network

curl -X POST https://api.shiftlabs.org/v1/runners/tokens \
  -H "authorization: Bearer $SHIFTLABS_API_KEY" -H "content-type: application/json" \
  -d '{"name": "prod-cluster", "pool": "prod", "workflows": ["restart-app", "rotate-certs"]}'

# 201 {"id": "rtk_…", "token": "slr_…", "name": "prod-cluster", "pool": "prod",
#      "workflows": ["restart-app", "rotate-certs"], "prefix": "slr_…", "createdAt": …}

export SHIFTLABS_RUNNER_TOKEN=slr_…   # from Settings → Runners

# Check the token: prints the pool and the workflows it serves, then exits.
docker run --rm -e SHIFTLABS_RUNNER_TOKEN shiftlabsorg/runner:1.0.0 check

docker run -d --name shiftlabs-runner --restart unless-stopped \
  -e SHIFTLABS_RUNNER_TOKEN \
  -e SHIFTLABS_RUNNER_NAME=build-host-1 \
  -v "$PWD/runner-kubeconfig:/etc/shiftlabs/kubeconfig:ro" -e KUBECONFIG=/etc/shiftlabs/kubeconfig \
  shiftlabsorg/runner:1.0.0

apiVersion: v1
kind: Namespace
metadata:
  name: shiftlabs-runner   # optional: any namespace works
---
apiVersion: v1
kind: Secret
metadata:
  name: shiftlabs-runner
  namespace: shiftlabs-runner
type: Opaque
stringData:
  token: slr_…   # from Settings → Runners
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: shiftlabs-runner
  namespace: shiftlabs-runner
---
# An example: read-only access to pods in the namespace apps, enough for kubectl get pods -n apps.
# Never let this ServiceAccount read Secrets in shiftlabs-runner: the token Secret is there.
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  name: shiftlabs-runner-read-pods
  namespace: apps
rules:
  - apiGroups: [""]
    resources: ["pods"]
    verbs: ["get", "list", "watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: shiftlabs-runner-read-pods
  namespace: apps
roleRef:
  apiGroup: rbac.authorization.k8s.io
  kind: Role
  name: shiftlabs-runner-read-pods
subjects:
  - kind: ServiceAccount
    name: shiftlabs-runner
    namespace: shiftlabs-runner
---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: shiftlabs-runner
  namespace: shiftlabs-runner
spec:
  replicas: 2
  selector:
    matchLabels:
      app: shiftlabs-runner
  template:
    metadata:
      labels:
        app: shiftlabs-runner
    spec:
      serviceAccountName: shiftlabs-runner
      terminationGracePeriodSeconds: 30
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      volumes:
        - name: work
          emptyDir: {}
        - name: tmp
          emptyDir: {}
        - name: home
          emptyDir: {}
      containers:
        - name: runner
          image: shiftlabsorg/runner:1.0.0
          env:
            - name: SHIFTLABS_RUNNER_TOKEN
              valueFrom:
                secretKeyRef:
                  name: shiftlabs-runner
                  key: token
            - name: SHIFTLABS_RUNNER_NAME
              valueFrom:
                fieldRef:
                  fieldPath: metadata.name
            # The runner makes this folder for itself: it refuses a work folder that others can write to.
            - name: SHIFTLABS_WORK_DIR
              value: /work/jobs
          volumeMounts:
            - name: work
              mountPath: /work
            - name: tmp
              mountPath: /tmp
            - name: home
              mountPath: /home/runner
          resources:
            requests:
              cpu: 100m
              memory: 256Mi
            limits:
              memory: 1Gi
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop: ["ALL"]

import { workflow } from "shiftlabs";

export default workflow<{ app: string }>(async ({ payload, step }) => {
  const pods = await step.exec("list pods", {
    command: ["kubectl", "get", "pods", "-n", "apps", "-o", "name"],
  });

  // Values go in env. A value pasted into the script would run as code.
  await step.exec("restart", {
    run: 'kubectl rollout restart "deployment/$APP" -n apps\nkubectl rollout status "deployment/$APP" -n apps --timeout=5m',
    env: { APP: payload.app },
    timeout: "10 minutes",
  });

  return { pods: pods.stdout.split("\n").filter(Boolean) };
});

from shiftlabs import workflow


@workflow
async def restart_app(ctx):
    pods = await ctx.step.exec(
        "list pods",
        command=["kubectl", "get", "pods", "-n", "apps", "-o", "name"],
    )

    # Values go in env. A value pasted into the script would run as code.
    await ctx.step.exec(
        "restart",
        run='kubectl rollout restart "deployment/$APP" -n apps\nkubectl rollout status "deployment/$APP" -n apps --timeout=5m',
        env={"APP": ctx.payload["app"]},
        timeout="10 minutes",
    )

    return {"pods": [p for p in pods["stdout"].split("\n") if p]}

import { ExecError, workflow } from "shiftlabs";

export default workflow<{ version: string }>(async ({ payload, step }) => {
  // kubectl exits with 1 when the deployment doesn't exist yet.
  const found = await step.exec("find web", {
    command: ["kubectl", "--kubeconfig", "kubeconfig", "get", "deployment", "web", "-n", "apps"],
    files: { kubeconfig: { secret: "STAGING_KUBECONFIG" } },
    okExitCodes: [0, 1],
  });

  try {
    await step.exec("deploy", {
      run: 'helm upgrade --install web oci://registry.example.com/charts/web --version "$VERSION" --kubeconfig kubeconfig --wait',
      env: { VERSION: payload.version },
      files: { kubeconfig: { secret: "STAGING_KUBECONFIG" } },
      runner: "staging",
      timeout: "20 minutes",
      retries: { limit: 2, delay: "1 minute" },
    });
  } catch (err) {
    if (err instanceof ExecError) return { deployed: false, exitCode: err.result.exitCode, stderr: err.result.stderr };
    throw err;
  }
  return { deployed: true, firstInstall: found.exitCode === 1 };
});

from shiftlabs import ExecError, workflow


@workflow
async def deploy_web(ctx):
    # kubectl exits with 1 when the deployment doesn't exist yet.
    found = await ctx.step.exec(
        "find web",
        command=["kubectl", "--kubeconfig", "kubeconfig", "get", "deployment", "web", "-n", "apps"],
        files={"kubeconfig": {"secret": "STAGING_KUBECONFIG"}},
        ok_exit_codes=[0, 1],
    )

    try:
        await ctx.step.exec(
            "deploy",
            run='helm upgrade --install web oci://registry.example.com/charts/web --version "$VERSION" --kubeconfig kubeconfig --wait',
            env={"VERSION": ctx.payload["version"]},
            files={"kubeconfig": {"secret": "STAGING_KUBECONFIG"}},
            runner="staging",
            timeout="20 minutes",
            retries={"limit": 2, "delay": "1 minute"},
        )
    except ExecError as err:
        return {"deployed": False, "exit_code": err.result["exit_code"], "stderr": err.result["stderr"]}
    return {"deployed": True, "first_install": found["exit_code"] == 1}

FROM shiftlabsorg/runner:1.0.0
USER root
RUN apt-get update && apt-get install -y --no-install-recommends postgresql-client \
  && rm -rf /var/lib/apt/lists/*
USER 1000

FROM your-registry.example.com/ops-tools:2026.10

COPY --from=shiftlabsorg/runner:1.0.0 /usr/local/bin/shiftlabs-runner /usr/local/bin/
USER 1000
ENTRYPOINT ["/usr/local/bin/shiftlabs-runner"]
CMD ["run"]