feat: more Jenkins tuning for trivy

Dockerfile

@@ -16,16 +16,19 @@ RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/reposit
 
 # Podman tweaks
 ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
-ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf
-
-RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
-             /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
-    touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
-          /var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock
 
 # Trivy html template
 ADD --chown=jenkins:jenkins html.tpl /home/jenkins
 
+# Rootless podman
+ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf
+
+RUN mkdir -p /tmp/podman-run-1000 /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
+             /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
+    touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
+          /var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \
+    chown jenkins:jenkins /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000
+
 # Patch jenkins-agent to launch podman service
 RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n        exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent
 
@@ -36,10 +39,13 @@ RUN ln -s /usr/bin/podman /usr/bin/docker
 RUN echo jenkins:100000:65536 > /etc/subuid \
  && echo jenkins:100000:65536 > /etc/subgid
 
+ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000
 ENV BUILDAH_ISOLATION=chroot
+ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"
+
+USER jenkins
 
 # Allow container layers to be stored in PVCs
 VOLUME /home/jenkins/.local/share/containers
 
-USER jenkins
 ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"]

Makefile

@@ -1,4 +1,4 @@
-VERSION ?= 0.2.0
+VERSION ?= 0.2.1
 BASE ?= latest-alpine-jdk11
 REGISTRY := public.ecr.aws/zero-downtime
 REPOSITORY := jenkins-podman