ARG BASE="4.11.2-4-alpine-jdk17-preview" FROM jenkins/inbound-agent:${BASE} ARG USER=jenkins USER root RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories \ && apk upgrade -U --available --no-cache \ && apk add --no-cache \ tini \ make \ yq \ strace \ fuse-overlayfs \ podman \ buildah \ aws-cli \ trivy # Trivy html template ADD --chown=jenkins:jenkins html.tpl /home/jenkins # Rootless podman RUN mkdir -p /home/$USER/.local/share/containers && \ chown $USER:$USER -R /home/$USER ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/ ADD --chown=$USER:$USER conf/podman-containers.conf /home/$USER/.config/containers/containers.conf RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \ /var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \ touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \ /var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \ mkdir /tmp/podman-run-1000 && chown $USER:$USER /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000 && \ echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subuid && \ echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subgid #setcap cap_setuid=ep /usr/bin/newuidmap && \ #setcap cap_setgid=ep /usr/bin/newgidmap && \ RUN mkdir /workspace && \ cd /usr/bin && ln -s podman docker # Patch jenkins-agent to launch podman service RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000 ENV _CONTAINERS_USERNS_CONFIGURED="" ENV BUILDAH_ISOLATION=chroot ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl" USER jenkins # Allow container layers to be stored in PVCs VOLUME /home/jenkins/.local/share/containers ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"]