Skip to content

Commit 444a2f9

Browse files
hasanawad94hasanawad94
committed
Enable read only rootfs config for the build containers
Sets the waiter container's lock file path to the generated temporary volume to prevent it from using its own filesystem. Signed-off-by: Hasan Awad <[email protected]>
1 parent d8447f9 commit 444a2f9

File tree

4 files changed

+20
-13
lines changed

4 files changed

+20
-13
lines changed

‎docs/configuration.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ The following environment variables are available:
2424
| `BUNDLE_CONTAINER_IMAGE` | Custom container image that pulls a bundle image to obtain the packaged source code. If `BUNDLE_IMAGE_CONTAINER_TEMPLATE` is also specifying an image, then the value for `BUNDLE_IMAGE_CONTAINER_IMAGE` has precedence. |
2525
| `IMAGE_PROCESSING_CONTAINER_TEMPLATE` | JSON representation of a [Container](https://pkg.go.dev/k8s.io/api/core/v1#Container) template that is used for steps that processes the image. Default is `{"image": "ghcr.io/shipwright-io/build/image-processing:latest", "command": ["/ko-app/image-processing"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"add": ["DAC_OVERRIDE"], "drop": ["ALL"]}, "runAsUser": 0, "runAsgGroup": 0}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
2626
| `IMAGE_PROCESSING_CONTAINER_IMAGE` | Custom container image that is used for steps that processes the image. If `IMAGE_PROCESSING_CONTAINER_TEMPLATE` is also specifying an image, then the value for `IMAGE_PROCESSING_CONTAINER_IMAGE` has precedence. |
27-
| `WAITER_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that waits for local source code to be uploaded to it. Default is `{"image":"ghcr.io/shipwright-io/build/waiter:latest", "command": ["/ko-app/waiter"], "args": ["start"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
27+
| `WAITER_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that waits for local source code to be uploaded to it. Default is `{"image":"ghcr.io/shipwright-io/build/waiter:latest", "command": ["/ko-app/waiter"], "args": ["start","--lock-file=/shp-tmp/waiter.lock"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
2828
| `WAITER_CONTAINER_IMAGE` | Custom container image that waits for local source code to be uploaded to it. If `WAITER_IMAGE_CONTAINER_TEMPLATE` is also specifying an image, then the value for `WAITER_IMAGE_CONTAINER_IMAGE` has precedence. |
2929
| `BUILD_CONTROLLER_LEADER_ELECTION_NAMESPACE` | Set the namespace to be used to store the `shipwright-build-controller` lock, by default it is in the same namespace as the controller itself. |
3030
| `BUILD_CONTROLLER_LEASE_DURATION` | Override the `LeaseDuration`, which is the duration that non-leader candidates will wait to force acquire leadership. |

‎pkg/config/config.go‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -187,8 +187,9 @@ func NewDefaultConfig() *Config {
187187
"ALL",
188188
},
189189
},
190-
RunAsUser: nonRoot,
191-
RunAsGroup: nonRoot,
190+
RunAsUser: nonRoot,
191+
RunAsGroup: nonRoot,
192+
ReadOnlyRootFilesystem: ptr.To(true),
192193
},
193194
},
194195

@@ -215,8 +216,9 @@ func NewDefaultConfig() *Config {
215216
"ALL",
216217
},
217218
},
218-
RunAsUser: nonRoot,
219-
RunAsGroup: nonRoot,
219+
RunAsUser: nonRoot,
220+
RunAsGroup: nonRoot,
221+
ReadOnlyRootFilesystem: ptr.To(true),
220222
},
221223
},
222224

@@ -241,6 +243,7 @@ func NewDefaultConfig() *Config {
241243
AllowPrivilegeEscalation: ptr.To(false),
242244
RunAsUser: root,
243245
RunAsGroup: root,
246+
ReadOnlyRootFilesystem: ptr.To(true),
244247
Capabilities: &corev1.Capabilities{
245248
Add: []corev1.Capability{
246249
"DAC_OVERRIDE",
@@ -259,6 +262,7 @@ func NewDefaultConfig() *Config {
259262
},
260263
Args: []string{
261264
"start",
265+
"--lock-file=/shp-tmp/waiter.lock", // Sets lock file path to the generated tmp volume to prevent it from using its own filesystem.
262266
},
263267
// This directory is created in the base image as writable for everybody
264268
Env: []corev1.EnvVar{
@@ -274,8 +278,9 @@ func NewDefaultConfig() *Config {
274278
"ALL",
275279
},
276280
},
277-
RunAsUser: nonRoot,
278-
RunAsGroup: nonRoot,
281+
RunAsUser: nonRoot,
282+
RunAsGroup: nonRoot,
283+
ReadOnlyRootFilesystem: ptr.To(true),
279284
},
280285
},
281286

‎pkg/config/config_test.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,9 @@ var _ = Describe("Config", func() {
142142
"ALL",
143143
},
144144
},
145-
RunAsUser: nonRoot,
146-
RunAsGroup: nonRoot,
145+
RunAsUser: nonRoot,
146+
RunAsGroup: nonRoot,
147+
ReadOnlyRootFilesystem: ptr.To(true),
147148
},
148149
}))
149150
})
@@ -234,7 +235,7 @@ var _ = Describe("Config", func() {
234235
Expect(config.WaiterContainerTemplate).To(Equal(Step{
235236
Image: "myregistry/custom/image",
236237
Command: []string{"/ko-app/waiter"},
237-
Args: []string{"start"},
238+
Args: []string{"start", "--lock-file=/shp-tmp/waiter.lock"},
238239
Env: []corev1.EnvVar{{Name: "HOME", Value: "/shared-home"}},
239240
SecurityContext: &corev1.SecurityContext{
240241
AllowPrivilegeEscalation: ptr.To(false),
@@ -243,8 +244,9 @@ var _ = Describe("Config", func() {
243244
"ALL",
244245
},
245246
},
246-
RunAsUser: nonRoot,
247-
RunAsGroup: nonRoot,
247+
RunAsUser: nonRoot,
248+
RunAsGroup: nonRoot,
249+
ReadOnlyRootFilesystem: ptr.To(true),
248250
},
249251
}))
250252
})

‎pkg/reconciler/buildrun/resources/sources/local_copy_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ var _ = Describe("LocalCopy", func() {
3232
Expect(len(taskSpec.Steps)).To(Equal(1))
3333
Expect(taskSpec.Steps[0].Name).To(Equal(sources.WaiterContainerName))
3434
Expect(taskSpec.Steps[0].Image).To(Equal(cfg.WaiterContainerTemplate.Image))
35-
Expect(taskSpec.Steps[0].Args).To(Equal([]string{"start", "--timeout=1m0s"}))
35+
Expect(taskSpec.Steps[0].Args).To(Equal([]string{"start", "--lock-file=/shp-tmp/waiter.lock", "--timeout=1m0s"}))
3636
})
3737
})
3838
})

0 commit comments

Comments
 (0)