feat: more Jenkins tuning for trivy
This commit is contained in:
parent
cb2d4486d1
commit
9c16e747d7
20
Dockerfile
20
Dockerfile
@ -16,16 +16,19 @@ RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/reposit
|
||||
|
||||
# Podman tweaks
|
||||
ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
|
||||
ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf
|
||||
|
||||
RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
|
||||
/var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
|
||||
touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
|
||||
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock
|
||||
|
||||
# Trivy html template
|
||||
ADD --chown=jenkins:jenkins html.tpl /home/jenkins
|
||||
|
||||
# Rootless podman
|
||||
ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf
|
||||
|
||||
RUN mkdir -p /tmp/podman-run-1000 /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
|
||||
/var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
|
||||
touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
|
||||
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \
|
||||
chown jenkins:jenkins /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000
|
||||
|
||||
# Patch jenkins-agent to launch podman service
|
||||
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent
|
||||
|
||||
@ -36,10 +39,13 @@ RUN ln -s /usr/bin/podman /usr/bin/docker
|
||||
RUN echo jenkins:100000:65536 > /etc/subuid \
|
||||
&& echo jenkins:100000:65536 > /etc/subgid
|
||||
|
||||
ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000
|
||||
ENV BUILDAH_ISOLATION=chroot
|
||||
ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"
|
||||
|
||||
USER jenkins
|
||||
|
||||
# Allow container layers to be stored in PVCs
|
||||
VOLUME /home/jenkins/.local/share/containers
|
||||
|
||||
USER jenkins
|
||||
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"]
|
||||
|
Loading…
Reference in New Issue
Block a user