ZeroDownTime/jenkins-podman
3
0
Fork 0
Code Issues 1 Pull Requests Packages Projects Releases Wiki Activity

feat: more Jenkins tuning for trivy

Browse Source
This commit is contained in:
Stefan Reimer 2022-01-14 01:23:18 +01:00
parent cb2d4486d1
commit 9c16e747d7
2 changed files with 14 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

20
Dockerfile
View File

@ -16,16 +16,19 @@ RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/reposit
# Podman tweaks # Podman tweaks
ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/ ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf
RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
/var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock
# Trivy html template # Trivy html template
ADD --chown=jenkins:jenkins html.tpl /home/jenkins ADD --chown=jenkins:jenkins html.tpl /home/jenkins
# Rootless podman
ADD --chown=jenkins:jenkins conf/podman-containers.conf /home/jenkins/.config/containers/containers.conf
RUN mkdir -p /tmp/podman-run-1000 /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
/var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \
chown jenkins:jenkins /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000
# Patch jenkins-agent to launch podman service # Patch jenkins-agent to launch podman service
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent
@ -36,10 +39,13 @@ RUN ln -s /usr/bin/podman /usr/bin/docker
RUN echo jenkins:100000:65536 > /etc/subuid \ RUN echo jenkins:100000:65536 > /etc/subuid \
&& echo jenkins:100000:65536 > /etc/subgid && echo jenkins:100000:65536 > /etc/subgid
ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000
ENV BUILDAH_ISOLATION=chroot ENV BUILDAH_ISOLATION=chroot
ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"
USER jenkins
# Allow container layers to be stored in PVCs # Allow container layers to be stored in PVCs
VOLUME /home/jenkins/.local/share/containers VOLUME /home/jenkins/.local/share/containers
USER jenkins
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"] ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"]

2
Makefile
View File

@ -1,4 +1,4 @@
VERSION ?= 0.2.0 VERSION ?= 0.2.1
BASE ?= latest-alpine-jdk11 BASE ?= latest-alpine-jdk11
REGISTRY := public.ecr.aws/zero-downtime REGISTRY := public.ecr.aws/zero-downtime
REPOSITORY := jenkins-podman REPOSITORY := jenkins-podman