jenkins-podman/Dockerfile

ARG BASE="4.11.2-4-alpine-jdk17-preview"

FROM jenkins/inbound-agent:${BASE}

ARG USER=jenkins

USER root
RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories \
    && apk upgrade -U --available --no-cache \
    && apk add --no-cache \
    tini \
    make \
    yq \
    strace \
    fuse-overlayfs \
    podman \
    buildah \
    aws-cli \
    trivy

# Trivy html template
ADD --chown=jenkins:jenkins html.tpl /home/jenkins

# Rootless podman
RUN mkdir -p /home/$USER/.local/share/containers && \
    chown $USER:$USER -R /home/$USER

ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
ADD --chown=$USER:$USER conf/podman-containers.conf /home/$USER/.config/containers/containers.conf

RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
             /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
    touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
          /var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \
    mkdir /tmp/podman-run-1000 && chown $USER:$USER /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000 && \
    echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subuid && \
    echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subgid
    #setcap cap_setuid=ep /usr/bin/newuidmap && \
    #setcap cap_setgid=ep /usr/bin/newgidmap && \
RUN mkdir /workspace && \
    cd /usr/bin && ln -s podman docker

# Patch jenkins-agent to launch podman service
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n        exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent

ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000
ENV _CONTAINERS_USERNS_CONFIGURED=""
ENV BUILDAH_ISOLATION=chroot
ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"

USER jenkins

# Allow container layers to be stored in PVCs
VOLUME /home/jenkins/.local/share/containers

ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"]