diff --git a/Dockerfile b/Dockerfile index cb7cc2b..586c34f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,6 @@ RUN apk upgrade -U --available --no-cache && apk add --no-cache \ make \ yq \ strace \ - fuse-overlayfs \ podman \ buildah \ aws-cli @@ -22,36 +21,25 @@ RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/reposit trivy # Trivy html template -ADD --chown=jenkins:jenkins html.tpl /home/jenkins +ADD --chown=$USER:$USER html.tpl /home/$USER # Rootless podman -RUN mkdir -p /home/$USER/.local/share/containers && \ - chown $USER:$USER -R /home/$USER +RUN mkdir -p /home/$USER/.config/containers -ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/ -ADD --chown=$USER:$USER conf/podman-containers.conf /home/$USER/.config/containers/containers.conf +ADD --chown=$USER:$USER conf/containers.conf conf/registries.conf conf/storage.conf /home/$USER/.config/containers -RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \ - /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \ - touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \ - /var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \ - mkdir /tmp/podman-run-1000 && chown $USER:$USER /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000 && \ - echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subuid && \ +RUN echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subuid && \ echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subgid && \ - mkdir /workspace && \ - cd /usr/bin && ln -s podman docker + cd /usr/bin && ln -s podman docker && \ + chown $USER:$USER -R /home/$USER # Patch jenkins-agent to launch podman service RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent -ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000 +ENV XDG_RUNTIME_DIR=/home/$USER/agent ENV _CONTAINERS_USERNS_CONFIGURED="" -ENV BUILDAH_ISOLATION=chroot ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl" USER $USER -# Allow container layers to be stored in PVCs -VOLUME /home/$USER/.local/share/containers - ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"] diff --git a/conf/containers.conf b/conf/containers.conf index 220c1f8..6c80b11 100644 --- a/conf/containers.conf +++ b/conf/containers.conf @@ -1,4 +1,5 @@ [containers] +volumes = [ "/proc:/proc" ] netns="host" userns="host" ipcns="host" diff --git a/conf/podman-containers.conf b/conf/podman-containers.conf deleted file mode 100644 index 503cca3..0000000 --- a/conf/podman-containers.conf +++ /dev/null @@ -1,4 +0,0 @@ -[containers] -volumes = [ - "/proc:/proc", -] diff --git a/conf/storage.conf b/conf/storage.conf index 633dfc4..16e3248 100644 --- a/conf/storage.conf +++ b/conf/storage.conf @@ -1,14 +1,4 @@ [storage] driver = "overlay" -runroot = "/run/containers/storage" -graphroot = "/var/lib/containers/storage" - -[storage.options] -additionalimagestores = [ -"/var/lib/shared", -] - -[storage.options.overlay] -mount_program = "/usr/bin/fuse-overlayfs" -mountopt = "nodev,fsync=0" -[storage.options.thinpool] +runroot = "/home/jenkins/agent/containers/run" +graphroot = "/home/jenkins/agent/containers/storage"