It should be possible to use another user than jenkins if you use a different container than the default jnlp one. IMO, the issue here is that you specifically create a user "user", but it will get a userid assigned by the command useradd.
ENV USER_NAME="user" ENV HOME="/home/${USER_NAME}" RUN mkdir -p ${HOME} WORKDIR $HOME
HTH
Mikaël Barbero
Team Lead - Release Engineering | Eclipse Foundation 📱 (+33) 642 028 039 | 🐦 @mikbarbero
Thanks Mickaël for this explanation. My dockerfile is hereafter, I already use a non root 'user', but then it is messy when jenkins connects, can I have only the jenkins user?
#tag eclipsekeyple/build:ssh
FROM maven:3.6-jdk-8
# Set up environment variables
ENV ANDROID_HOME="/home/user/android-sdk-linux" \
SDK_URL="https://dl.google.com/android/repository/sdk-tools-linux-3859397.zip" \
GRADLE_URL="https://services.gradle.org/distributions/gradle-4.5.1-all.zip"
# Create a non-root user
RUN useradd -m user
USER user
WORKDIR /home/user
# Download Android SDK
RUN mkdir "$ANDROID_HOME" .android \
&& cd "$ANDROID_HOME" \
&& curl -o sdk.zip $SDK_URL \
&& unzip sdk.zip \
&& rm sdk.zip \
&& yes | $ANDROID_HOME/tools/bin/sdkmanager --licenses
# Install Gradle
RUN wget $GRADLE_URL -O gradle.zip \
&& unzip gradle.zip \
&& mv gradle-4.5.1 gradle \
&& rm gradle.zip \
&& mkdir .gradle
ENV PATH="/home/user/gradle/bin:${ANDROID_HOME}/tools:${ANDROID_HOME}/platform-tools:${PATH}"
USER root
### give rights to android_home folder
RUN chgrp -R 0 "$ANDROID_HOME" \
&& chmod -R g=u "$ANDROID_HOME"
### user name recognition at runtime w/ an arbitrary uid - for OpenShift deployments
COPY docker_scripts/uid_entrypoint /usr/local/bin/uid_entrypoint
RUN chmod u+x /usr/local/bin/uid_entrypoint && \
chgrp 0 /usr/local/bin/uid_entrypoint && \
chmod g=u /usr/local/bin/uid_entrypoint /etc/passwd
### end
ENTRYPOINT [ "uid_entrypoint" ]
USER 1000100000
The USER directive in dockerfile are just the hint for the runtime. Even with a local docker daemon, you can start your image with
$ docker run -it --rm -u 100001:0 busybox
and then in the container, you will see
/ $ id uid=100001 gid=0(root)
The USER 10001 directive we add at the end of all dockerfiles are just to inform the user that those image are made to not run as root.
Now, regarding Openshift, in the background it does something like this:
$ docker run -it --rm -u 100010000:0 yourrepo/yourimage
So what matters is to be ready to run as non root.
If you still face issue, feel free to paste your dockerfile here.
Cheers,
Mikaël Barbero
Team Lead - Release Engineering | Eclipse Foundation 📱 (+33) 642 028 039 | 🐦 @mikbarbero
Thanks Frederic, indeed it worked for the jnlp agent :)
Is that correct?
Hi,
In "sshagent ( ['project-storage.eclipse.org-bot-ssh'])" you have to use
the ID (a sequence of numbers). You can use the pipeline syntax
generator to select the right credential and see the corresponding ID.
Obviously the wiki was misleading in that regard. I will improve the
section covering that topic.
Regards,
Fred
On 20.03.19 11:39, Olivier Delcroix wrote:
> Hi folks,
>
> I've been struggling with the ssh agent yersterday with my custom
> container. I can't get rid of the 100010000 user error. I have modified
> my container based on the
> example https://github.com/eclipse-cbi/dockerfiles to run the
> appropriate script in ENTRYPOINT, but I must have missed something.
>
> By the way, in the previous examples, the user is 10001 whereas in the
> openshift it is 100010000, am I understanding it right?
>
> --
>
> So today, I'm trying something much simpler, I execute the following
> basic pipeline within the default container, but I'm getting the error
> "genie.keyple@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
> <mailto:genie.keyple@xxxxxxxxxxxxxxxxxxxxxxxxxxxx>: Permission denied
> (publickey,keyboard-interactive)."
>
> pipeline {
> agent any
> stages {
> stage('Test SSH') {
> steps {
> sshagent ( ['project-storage.eclipse.org-bot-ssh']) {
> sh '''
> ssh genie.keyple@xxxxxxxxxxxxxxxxxxxxxxxxxxxx
> <mailto:genie.keyple@xxxxxxxxxxxxxxxxxxxxxxxxxxxx> mkdir -p
> /home/data/httpd/download.eclipse.org/keyple/snapshots
> <http://download.eclipse.org/keyple/snapshots>
> '''
> }
> }
> }
> }
> }
>
> --
>
> I've been through all the wiki and docs, I think I have reached the
> limits of my capabilities in terms of k8/docker/openshift/devops...
> could I get a hand from someone on my pipelines? I am a bit desperate :)
> do I sound like it?
>
> If you want to have a quick look :
> First pipeline is here
> : https://jenkins.eclipse.org/keyple/job/test_ssh_pipeline/
> Second is here : https://jenkins.eclipse.org/keyple/job/test_jnlp_ssh/
>
> my custom container is attached
>
> Thanks in advance!
> Olivier
>
> _______________________________________________
> cbi-dev mailing list
> cbi-dev@xxxxxxxxxxx
> To change your delivery options, retrieve your password, or unsubscribe from this list, visit
> https://www.eclipse.org/mailman/listinfo/cbi-dev
>
--
Frederic Gurr
Release Engineer | Eclipse Foundation Europe GmbH
Annastr. 46, D-64673 Zwingenberg
Handelsregister: Darmstadt HRB 92821
Managing Directors: Ralph Mueller, Mike Milinkovich, Chris Laroque
_______________________________________________
cbi-dev mailing list
cbi-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://www.eclipse.org/mailman/listinfo/cbi-dev
_______________________________________________ cbi-dev mailing list cbi-dev@xxxxxxxxxxxTo change your delivery options, retrieve your password, or unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/cbi-dev
cbi-dev mailing list
cbi-dev@xxxxxxxxxxx
To change your delivery options, retrieve your password, or unsubscribe from this list, visit
https://www.eclipse.org/mailman/listinfo/cbi-dev
_______________________________________________ cbi-dev mailing list cbi-dev@xxxxxxxxxxxTo change your delivery options, retrieve your password, or unsubscribe from this list, visit https://www.eclipse.org/mailman/listinfo/cbi-dev
|
