diff --git a/Dockerfile b/Dockerfile index cc39a06..a319b2c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,6 +6,7 @@ USER root RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories \ && apk upgrade -U -a \ && apk --no-cache add \ + tini \ make \ fuse-overlayfs \ podman \ @@ -25,6 +26,9 @@ RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \ # Trivy html template ADD --chown=jenkins:jenkins html.tpl /home/jenkins +# Patch jenkins-agent to launch podman service +RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent + # Make docker in Jenkinsfiles work RUN ln -s /usr/bin/podman /usr/bin/docker @@ -38,3 +42,4 @@ ENV BUILDAH_ISOLATION=chroot VOLUME /home/jenkins/.local/share/containers USER jenkins +ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"] diff --git a/Makefile b/Makefile index a7c00b6..58aebdb 100644 --- a/Makefile +++ b/Makefile @@ -1,4 +1,4 @@ -VERSION ?= 0.1.2 +VERSION ?= 0.2.0 BASE ?= latest-alpine-jdk11 REGISTRY := public.ecr.aws/zero-downtime REPOSITORY := jenkins-podman @@ -10,7 +10,7 @@ else TRIVY_OPTS := client --remote ${TRIVY_REMOTE} endif -.PHONY: build push clean scan +.PHONY: build push scan all: build @@ -22,9 +22,5 @@ push: podman tag $(TAG) $(REGISTRY)/$(TAG) podman push $(REGISTRY)/$(TAG) -clean: - rm -f image.tar trivy-report.html - scan: - [ -f image.tar ] || podman save $(TAG) -o image.tar - trivy $(TRIVY_OPTS) --input image.tar + trivy $(TRIVY_OPTS) $(TAG) diff --git a/trivy.html b/trivy.html deleted file mode 100644 index 86efffc..0000000 --- a/trivy.html +++ /dev/null @@ -1,275 +0,0 @@ - - -
- - -alpine | |||||
---|---|---|---|---|---|
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
jar | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
Package | -Vulnerability ID | -Severity | -Installed Version | -Fixed Version | -Links | -
github.com/containerd/containerd | -CVE-2021-41103 | -HIGH | -v1.5.5 | -v1.4.11, v1.5.7 | -- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41103 - https://github.com/containerd/containerd/commit/5b46e404f6b9f661a205e28d59c982d3634148f8 - https://github.com/containerd/containerd/security/advisories/GHSA-c2h3-6mxw-7mvq - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/B5Q6G6I4W5COQE25QMC7FJY3I3PAYFBB/ - https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ZNFADTCHHYWVM6W4NJ6CB4FNFM2VMBIB/ - https://nvd.nist.gov/vuln/detail/CVE-2021-41103 - https://ubuntu.com/security/notices/USN-5100-1 - https://www.debian.org/security/2021/dsa-5002 - | -
github.com/opencontainers/image-spec | -GMS-2021-101 | -UNKNOWN | -v1.0.2-0.20210819154149-5ad6f50d6283 | -1.0.2 | -- https://github.com/advisories/GHSA-77vh-xpmg-72qh - https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m - https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c - https://github.com/opencontainers/image-spec/releases/tag/v1.0.2 - https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh - | -
golang.org/x/text | -CVE-2021-38561 | -UNKNOWN | -v0.3.6 | -0.3.7 | -- | -
No Misconfigurations found | |||||
gobinary | |||||
Package | -Vulnerability ID | -Severity | -Installed Version | -Fixed Version | -Links | -
golang.org/x/crypto | -CVE-2020-29652 | -HIGH | -v0.0.0-20201112155050-0c6587e931a9 | -v0.0.0-20201216223049-8b5274cf687f | -- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29652 - https://go-review.googlesource.com/c/crypto/+/278852 - https://groups.google.com/g/golang-announce/c/ouZIlBimOsE?pli=1 - https://linux.oracle.com/cve/CVE-2020-29652.html - https://linux.oracle.com/errata/ELSA-2021-1796.html - https://lists.apache.org/thread.html/r68032132c0399c29d6cdc7bd44918535da54060a10a12b1591328bff@%3Cnotifications.skywalking.apache.org%3E - https://nvd.nist.gov/vuln/detail/CVE-2020-29652 - | -
golang.org/x/text | -CVE-2021-38561 | -UNKNOWN | -v0.3.5 | -0.3.7 | -- | -
No Misconfigurations found | |||||
gobinary | |||||
Package | -Vulnerability ID | -Severity | -Installed Version | -Fixed Version | -Links | -
github.com/opencontainers/image-spec | -GMS-2021-101 | -UNKNOWN | -v1.0.2-0.20210819154149-5ad6f50d6283 | -1.0.2 | -- https://github.com/advisories/GHSA-77vh-xpmg-72qh - https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m - https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c - https://github.com/opencontainers/image-spec/releases/tag/v1.0.2 - https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh - | -
No Misconfigurations found | |||||
gobinary | |||||
Package | -Vulnerability ID | -Severity | -Installed Version | -Fixed Version | -Links | -
github.com/opencontainers/image-spec | -GMS-2021-101 | -UNKNOWN | -v1.0.2-0.20190823105129-775207bd45b6 | -1.0.2 | -- https://github.com/advisories/GHSA-77vh-xpmg-72qh - https://github.com/opencontainers/distribution-spec/security/advisories/GHSA-mc8v-mgrf-8f4m - https://github.com/opencontainers/image-spec/commit/693428a734f5bab1a84bd2f990d92ef1111cd60c - https://github.com/opencontainers/image-spec/releases/tag/v1.0.2 - https://github.com/opencontainers/image-spec/security/advisories/GHSA-77vh-xpmg-72qh - | -
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found | |||||
gobinary | |||||
No Vulnerabilities found | |||||
No Misconfigurations found |