jenkins-podman/Dockerfile

# https://github.com/containers/podman/blob/main/contrib/podmanimage/stable/Containerfile
# https://hub.docker.com/r/jenkins/inbound-agent/tags


FROM jenkins/inbound-agent:alpine-jdk21@sha256:598ee03b9a48e49c0d3df1db9e1c897cd82726dd84bb130944148e7ead70861a

ARG BUILDUSER=jenkins

USER root
RUN echo "@edge-testing http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories && \
    apk upgrade -U --available --no-cache && \
    apk add --no-cache \
      tini \
      make \
      jq \
      yq \
      strace \
      fuse-overlayfs \
      podman \
      buildah \
      py-boto3 \
      aws-cli \
      trivy@edge-testing

# Trivy html template
ADD --chown=$BUILDUSER:$BUILDUSER html.tpl /home/$BUILDUSER

# Rootless podman
RUN mkdir -p /home/$BUILDUSER/.config/containers

ADD entrypoint.sh /usr/local/bin/entrypoint.sh
# conf/registries.conf will be mounted RO at runtime to inherit worker settings incl. caching proxies
ADD --chown=$BUILDUSER:$BUILDUSER conf/containers.conf conf/storage.conf /home/$BUILDUSER/.config/containers

RUN echo -e "$BUILDUSER:100000:65535" > /etc/subuid && \
    echo -e "$BUILDUSER:100000:65535" > /etc/subgid && \
    cd /usr/bin && ln -s podman docker && \
    chown $BUILDUSER:$BUILDUSER -R /home/$BUILDUSER

# Patch jenkins-agent to launch podman service
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n        exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent

ENV XDG_RUNTIME_DIR=/home/$BUILDUSER/agent/xdg-run
ENV XDG_CONFIG_HOME=/home/$BUILDUSER/.config

# Not needed on containerd and actually breaks `podman build`
#ENV BUILDAH_ISOLATION=chroot
#ENV _CONTAINERS_USERNS_CONFIGURED=""

# Until we setup the logging and metrics pipelines in OTEL
ENV OTEL_LOGS_EXPORTER=none
ENV OTEL_METRICS_EXPORTER=none

USER $BUILDUSER

ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/entrypoint.sh"]