58 lines
2.0 KiB
Docker
58 lines
2.0 KiB
Docker
# https://github.com/containers/podman/blob/main/contrib/podmanimage/stable/Containerfile
|
|
|
|
ARG BASE="4.13-2-alpine-jdk17-preview"
|
|
|
|
FROM jenkins/inbound-agent:${BASE}
|
|
|
|
ARG USER=jenkins
|
|
|
|
USER root
|
|
RUN apk upgrade -U --available --no-cache && apk add --no-cache \
|
|
tini \
|
|
make \
|
|
yq \
|
|
strace \
|
|
fuse-overlayfs \
|
|
podman \
|
|
buildah \
|
|
aws-cli
|
|
|
|
RUN echo "http://dl-cdn.alpinelinux.org/alpine/edge/testing" >> /etc/apk/repositories && \
|
|
apk upgrade -U --available --no-cache && apk add --no-cache \
|
|
trivy
|
|
|
|
# Trivy html template
|
|
ADD --chown=jenkins:jenkins html.tpl /home/jenkins
|
|
|
|
# Rootless podman
|
|
RUN mkdir -p /home/$USER/.local/share/containers && \
|
|
chown $USER:$USER -R /home/$USER
|
|
|
|
ADD conf/containers.conf conf/registries.conf conf/storage.conf /etc/containers/
|
|
ADD --chown=$USER:$USER conf/podman-containers.conf /home/$USER/.config/containers/containers.conf
|
|
|
|
RUN mkdir -p /var/lib/shared/overlay-images /var/lib/shared/overlay-layers \
|
|
/var/lib/shared/vfs-images /var/lib/shared/vfs-layers && \
|
|
touch /var/lib/shared/overlay-images/images.lock /var/lib/shared/overlay-layers/layers.lock \
|
|
/var/lib/shared/vfs-images/images.lock /var/lib/shared/vfs-layers/layers.lock && \
|
|
mkdir /tmp/podman-run-1000 && chown $USER:$USER /tmp/podman-run-1000 && chmod 700 /tmp/podman-run-1000 && \
|
|
echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subuid && \
|
|
echo -e "$USER:1:999\n$USER:1001:64535" > /etc/subgid && \
|
|
mkdir /workspace && \
|
|
cd /usr/bin && ln -s podman docker
|
|
|
|
# Patch jenkins-agent to launch podman service
|
|
RUN sed -i -e 's/exec \$JAVA_BIN/podman system service -t0\&\n exec \$JAVA_BIN/' /usr/local/bin/jenkins-agent
|
|
|
|
ENV XDG_RUNTIME_DIR=/tmp/podman-run-1000
|
|
ENV _CONTAINERS_USERNS_CONFIGURED=""
|
|
ENV BUILDAH_ISOLATION=chroot
|
|
ENV TRIVY_TEMPLATE="@/home/jenkins/html.tpl"
|
|
|
|
USER $USER
|
|
|
|
# Allow container layers to be stored in PVCs
|
|
VOLUME /home/$USER/.local/share/containers
|
|
|
|
ENTRYPOINT ["/sbin/tini", "--", "/usr/local/bin/jenkins-agent"]
|