ZeroDownTime/jenkins-podman
3
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

fix: Improve rootless podman config

Browse Source
This commit is contained in:
Stefan Reimer 2022-06-27 19:16:02 +02:00
parent c0b5cbdafb
commit 38adce6ea9
1 changed files with 17 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

30
Dockerfile
View File

@ -2,6 +2,8 @@ ARG BASE="4.11.2-4-alpine-jdk17-preview"
FROM jenkins/inbound-agent:${BASE} FROM jenkins/inbound-agent:${BASE}
ARG USER=jenkins
USER root USER root
RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories \ RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories \
&& apk upgrade -U --available --no-cache \ && apk upgrade -U --available --no-cache \
@ -9,38 +11,40 @@ RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/reposit
tini \ tini \
make \ make \
yq \ yq \
strace \
fuse-overlayfs \ fuse-overlayfs \
podman \ podman \
buildah \ buildah \
aws-cli \ aws-cli \
trivy trivy
# Podman tweaks
ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
# Trivy html template # Trivy html template
ADD --chown=jenkins:jenkins html.tpl /home/jenkins ADD --chown=jenkins:jenkins html.tpl /home/jenkins
# Rootless podman # Rootless podman
ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf RUN mkdir -p /home/$USER/.local/share/containers && \
chown $USER:$USER -R /home/$USER
RUN mkdir -p /tmp/podman-run-1000 /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \ ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
ADD --chown=$USER:$USER conf/podman-containers.conf /home/$USER/.config/containers/containers.conf
RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
/var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \ /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \ touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \ /var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \
chown jenkins:jenkins /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000 mkdir /tmp/podman-run-1000 && chown $USER:$USER /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000 && \
echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subuid && \
echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subgid
#setcap cap_setuid=ep /usr/bin/newuidmap && \
#setcap cap_setgid=ep /usr/bin/newgidmap && \
RUN mkdir /workspace && \
cd /usr/bin && ln -s podman docker
# Patch jenkins-agent to launch podman service # Patch jenkins-agent to launch podman service
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent
# Make docker in Jenkinsfiles work
RUN ln -s /usr/bin/podman /usr/bin/docker
# Rootless podman
RUN echo jenkins:100000:65536 > /etc/subuid \
&& echo jenkins:100000:65536 > /etc/subgid
ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000 ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000
ENV _CONTAINERS_USERNS_CONFIGURED=""
ENV BUILDAH_ISOLATION=chroot ENV BUILDAH_ISOLATION=chroot
ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl" ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"