Skip to content

Commit 04f6580

Browse files
hasanawad94hasanawad94
committed
Enable read only rootfs config for the build containers
Sets `ReadOnlyRootFilesystem` to true for Git,Bundle,Image-procesing,Waiter containers. Sets the waiter container's lock file path to the generated temporary volume to prevent it from using its own filesystem. Signed-off-by: Hasan Awad <[email protected]>
1 parent d8447f9 commit 04f6580

File tree

4 files changed

+20
-13
lines changed

4 files changed

+20
-13
lines changed

‎docs/configuration.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ The following environment variables are available:
2424
| `BUNDLE_CONTAINER_IMAGE` | Custom container image that pulls a bundle image to obtain the packaged source code. If `BUNDLE_IMAGE_CONTAINER_TEMPLATE` is also specifying an image, then the value for `BUNDLE_IMAGE_CONTAINER_IMAGE` has precedence. |
2525
| `IMAGE_PROCESSING_CONTAINER_TEMPLATE` | JSON representation of a [Container](https://pkg.go.dev/k8s.io/api/core/v1#Container) template that is used for steps that processes the image. Default is `{"image": "ghcr.io/shipwright-io/build/image-processing:latest", "command": ["/ko-app/image-processing"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"add": ["DAC_OVERRIDE"], "drop": ["ALL"]}, "runAsUser": 0, "runAsgGroup": 0}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
2626
| `IMAGE_PROCESSING_CONTAINER_IMAGE` | Custom container image that is used for steps that processes the image. If `IMAGE_PROCESSING_CONTAINER_TEMPLATE` is also specifying an image, then the value for `IMAGE_PROCESSING_CONTAINER_IMAGE` has precedence. |
27-
| `WAITER_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that waits for local source code to be uploaded to it. Default is `{"image":"ghcr.io/shipwright-io/build/waiter:latest", "command": ["/ko-app/waiter"], "args": ["start"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
27+
| `WAITER_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that waits for local source code to be uploaded to it. Default is `{"image":"ghcr.io/shipwright-io/build/waiter:latest", "command": ["/ko-app/waiter"], "args": ["start","--lock-file=/shp-tmp/waiter.lock"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
2828
| `WAITER_CONTAINER_IMAGE` | Custom container image that waits for local source code to be uploaded to it. If `WAITER_IMAGE_CONTAINER_TEMPLATE` is also specifying an image, then the value for `WAITER_IMAGE_CONTAINER_IMAGE` has precedence. |
2929
| `BUILD_CONTROLLER_LEADER_ELECTION_NAMESPACE` | Set the namespace to be used to store the `shipwright-build-controller` lock, by default it is in the same namespace as the controller itself. |
3030
| `BUILD_CONTROLLER_LEASE_DURATION` | Override the `LeaseDuration`, which is the duration that non-leader candidates will wait to force acquire leadership. |

‎pkg/config/config.go‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,9 @@ func NewDefaultConfig() *Config {
187187
"ALL",
188188
},
189189
},
190-
RunAsUser: nonRoot,
191-
RunAsGroup: nonRoot,
190+
RunAsUser: nonRoot,
191+
RunAsGroup: nonRoot,
192+
ReadOnlyRootFilesystem: ptr.To(true),
192193
},
193194
},
194195

@@ -215,8 +216,9 @@ func NewDefaultConfig() *Config {
215216
"ALL",
216217
},
217218
},
218-
RunAsUser: nonRoot,
219-
RunAsGroup: nonRoot,
219+
RunAsUser: nonRoot,
220+
RunAsGroup: nonRoot,
221+
ReadOnlyRootFilesystem: ptr.To(true),
220222
},
221223
},
222224

@@ -241,6 +243,7 @@ func NewDefaultConfig() *Config {
241243
AllowPrivilegeEscalation: ptr.To(false),
242244
RunAsUser: root,
243245
RunAsGroup: root,
246+
ReadOnlyRootFilesystem: ptr.To(true),
244247
Capabilities: &corev1.Capabilities{
245248
Add: []corev1.Capability{
246249
"DAC_OVERRIDE",
@@ -259,6 +262,7 @@ func NewDefaultConfig() *Config {
259262
},
260263
Args: []string{
261264
"start",
265+
"--lock-file=/shp-tmp/waiter.lock", // Sets lock file path to the generated tmp volume to prevent it from using its own filesystem.
262266
},
263267
// This directory is created in the base image as writable for everybody
264268
Env: []corev1.EnvVar{
@@ -274,8 +278,9 @@ func NewDefaultConfig() *Config {
274278
"ALL",
275279
},
276280
},
277-
RunAsUser: nonRoot,
278-
RunAsGroup: nonRoot,
281+
RunAsUser: nonRoot,
282+
RunAsGroup: nonRoot,
283+
ReadOnlyRootFilesystem: ptr.To(true),
279284
},
280285
},
281286

‎pkg/config/config_test.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,9 @@ var _ = Describe("Config", func() {
142142
"ALL",
143143
},
144144
},
145-
RunAsUser: nonRoot,
146-
RunAsGroup: nonRoot,
145+
RunAsUser: nonRoot,
146+
RunAsGroup: nonRoot,
147+
ReadOnlyRootFilesystem: ptr.To(true),
147148
},
148149
}))
149150
})
@@ -234,7 +235,7 @@ var _ = Describe("Config", func() {
234235
Expect(config.WaiterContainerTemplate).To(Equal(Step{
235236
Image: "myregistry/custom/image",
236237
Command: []string{"/ko-app/waiter"},
237-
Args: []string{"start"},
238+
Args: []string{"start", "--lock-file=/shp-tmp/waiter.lock"},
238239
Env: []corev1.EnvVar{{Name: "HOME", Value: "/shared-home"}},
239240
SecurityContext: &corev1.SecurityContext{
240241
AllowPrivilegeEscalation: ptr.To(false),
@@ -243,8 +244,9 @@ var _ = Describe("Config", func() {
243244
"ALL",
244245
},
245246
},
246-
RunAsUser: nonRoot,
247-
RunAsGroup: nonRoot,
247+
RunAsUser: nonRoot,
248+
RunAsGroup: nonRoot,
249+
ReadOnlyRootFilesystem: ptr.To(true),
248250
},
249251
}))
250252
})

‎pkg/reconciler/buildrun/resources/sources/local_copy_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ var _ = Describe("LocalCopy", func() {
3232
Expect(len(taskSpec.Steps)).To(Equal(1))
3333
Expect(taskSpec.Steps[0].Name).To(Equal(sources.WaiterContainerName))
3434
Expect(taskSpec.Steps[0].Image).To(Equal(cfg.WaiterContainerTemplate.Image))
35-
Expect(taskSpec.Steps[0].Args).To(Equal([]string{"start", "--timeout=1m0s"}))
35+
Expect(taskSpec.Steps[0].Args).To(Equal([]string{"start", "--lock-file=/shp-tmp/waiter.lock", "--timeout=1m0s"}))
3636
})
3737
})
3838
})

0 commit comments

Comments
 (0)