Configure `doas` on the OpenBSD images

[alexander-naumov]

Configure doas in the OpenBSD VM images so that the runner user can execute commands as root with it, in addition to the existing sudo support.

Background

This issue started as a question about how to install packages on OpenBSD (see the comments below). The answer is that sudo is available and already configured — it's documented in the openbsd-builder repository — but doas is not:

$ doas pkg_add package_name
doas: doas is not enabled, /etc/doas.conf: No such file or directory

doas is OpenBSD's own privilege escalation tool and the one OpenBSD users will reach for first, so its absence is surprising on an OpenBSD image even though sudo works.

Proposal

• Ship an /etc/doas.conf in the OpenBSD images that permits the runner user to run commands as root without a password, mirroring the current sudo configuration.
• Keep sudo configured exactly as it is today. Workflows that run the same script across several operating systems rely on sudo being available everywhere, so it should stay as the portable option.
• Document doas alongside sudo in the openbsd-builder readme.

The implementation lands in openbsd-builder, not in this repository.

Original question by @alexander-naumov

Hello,
I'm trying to use this action for OpenBSD build. I need to install dependency inside OpenBSD.
As I can see, it runs as runner user. This user is not allowed to install packages.

pkg_add package_name doesn't work.
We get an error pkg_add: pkg_add must be run as root. This is correct. Normally we execute pkg_add as a root user or via doas.

doas pkg_add package_name doesn't work.
We get an error doas: doas is not enabled, /etc/doas.conf: No such file or directory

So, my question is: how to install software inside OpenBSD?

[manxorist]

sudo works for me (https://github.com/OpenMPT/openmpt/blob/91768c03cdca42dc0a293576c351008d39bd26df/.github/workflows/OpenBSD-7.4-Makefile.yml#L30)

[jacob-carlborg]

So, my question is: how to install software inside OpenBSD?

@alexander-naumov as mentioned, sudo is available. Perhaps not that visible, but it's documented in the openbsd-builder repository [1]. I'm not that familiar with OpenBSD, is doas what's expected to be used instead of sudo?

[1] https://github.com/cross-platform-actions/openbsd-builder#openbsd-builder

[manxorist]

As far as I understand it (not an OpenBSD user either), doas is OpenBSD's recommended replacement for sudo. Given that sudo's configuration syntax has always been very confusing for me (which is a really bad sign for a security-related tool), I can understand their motivation.
I think a working doas configuration for OpenBSD would be desirable. I would also keep sudo as currently configured, to allow for consistent use of sudo across different systems.

[alexander-naumov]

Thank you guys! It works.

[kobalicek]

BTW I had some similar issues and to unify builds of my projects I have created build-actions script, that does a preparation by installing cmake and a C/C++ compiler. I didn't really intend to promote this as it's mostly for my use cases, but if you want to take a look and get some inspiration:

https://github.com/build-actions/build-actions

It's written in python, so it also has a prepare-environment.sh script, which installs python.

This works for me on Windows, Linux, Mac, and BSD VMs. If anyone wants to use this or extend that I'm interested in making it better.

[jacob-carlborg]

I've repurposed this issue into a feature request for configuring doas on the OpenBSD images, as suggested by @manxorist above. The original question is answered — sudo is available and configured — and is preserved in the issue description.

---

Generated by Claude Code