Skip to content

Commit 4cb7753

Browse files
hasanawad94hasanawad94
committed
Enable read only rootfs config for the build containers
Sets `ReadOnlyRootFilesystem` to true for Git,Bundle,Image-procesing,Waiter containers. Sets the waiter container's lock file path to the generated tmp volume, to prevent it from using its own filesystem. Signed-off-by: Hasan Awad <[email protected]>
1 parent 09535f7 commit 4cb7753

File tree

4 files changed

+23
-16
lines changed

4 files changed

+23
-16
lines changed

‎docs/configuration.md‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -18,13 +18,13 @@ The following environment variables are available:
1818
| `REMOTE_ARTIFACTS_CONTAINER_IMAGE` | Specify the container image used for the `.spec.sources` remote artifacts download, by default it uses `quay.io/quay/busybox:latest`. |
1919
| `TERMINATION_LOG_PATH` | Path of the termination log. This is where controller application will write the reason of its termination. Default value is `/dev/termination-log`. |
2020
| `GIT_ENABLE_REWRITE_RULE` | Enable Git wrapper to setup a URL `insteadOf` Git config rewrite rule for the respective source URL hostname. Default is `false`. |
21-
| `GIT_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that is used for steps that clone a Git repository. Default is `{"image": "ghcr.io/shipwright-io/build/git:latest", "command": ["/ko-app/git"], "env": [{"name": "HOME", "value": "/shared-home"},{"name": "GIT_SHOW_LISTING", "value": "false"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser": 1000,"runAsGroup": 1000}}` [^1]. The following properties are ignored as they are set by the controller: `args`, `name`. |
21+
| `GIT_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that is used for steps that clone a Git repository. Default is `{"image": "ghcr.io/shipwright-io/build/git:latest", "command": ["/ko-app/git"], "env": [{"name": "HOME", "value": "/shared-home"},{"name": "GIT_SHOW_LISTING", "value": "false"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser": 1000,"runAsGroup": 1000}, readOnlyRootFilesystem: true}` [^1]. The following properties are ignored as they are set by the controller: `args`, `name`. |
2222
| `GIT_CONTAINER_IMAGE` | Custom container image for Git clone steps. If `GIT_CONTAINER_TEMPLATE` is also specifying an image, then the value for `GIT_CONTAINER_IMAGE` has precedence. |
23-
| `BUNDLE_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that is used for steps that pulls a bundle image to obtain the packaged source code. Default is `{"image": "ghcr.io/shipwright-io/build/bundle:latest", "command": ["/ko-app/bundle"], "env": [{"name": "HOME","value": "/shared-home"},{"name": "BUNDLE_SHOW_LISTING","value": "false"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}}` [^1]. The following properties are ignored as they are set by the controller: `args`, `name`. |
23+
| `BUNDLE_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that is used for steps that pulls a bundle image to obtain the packaged source code. Default is `{"image": "ghcr.io/shipwright-io/build/bundle:latest", "command": ["/ko-app/bundle"], "env": [{"name": "HOME","value": "/shared-home"},{"name": "BUNDLE_SHOW_LISTING","value": "false"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}, readOnlyRootFilesystem: true}` [^1]. The following properties are ignored as they are set by the controller: `args`, `name`. |
2424
| `BUNDLE_CONTAINER_IMAGE` | Custom container image that pulls a bundle image to obtain the packaged source code. If `BUNDLE_IMAGE_CONTAINER_TEMPLATE` is also specifying an image, then the value for `BUNDLE_IMAGE_CONTAINER_IMAGE` has precedence. |
25-
| `IMAGE_PROCESSING_CONTAINER_TEMPLATE` | JSON representation of a [Container](https://pkg.go.dev/k8s.io/api/core/v1#Container) template that is used for steps that processes the image. Default is `{"image": "ghcr.io/shipwright-io/build/image-processing:latest", "command": ["/ko-app/image-processing"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"add": ["DAC_OVERRIDE"], "drop": ["ALL"]}, "runAsUser": 0, "runAsgGroup": 0}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
25+
| `IMAGE_PROCESSING_CONTAINER_TEMPLATE` | JSON representation of a [Container](https://pkg.go.dev/k8s.io/api/core/v1#Container) template that is used for steps that processes the image. Default is `{"image": "ghcr.io/shipwright-io/build/image-processing:latest", "command": ["/ko-app/image-processing"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext": {"allowPrivilegeEscalation": false, "capabilities": {"add": ["DAC_OVERRIDE"], "drop": ["ALL"]}, "runAsUser": 0, "runAsgGroup": 0}, readOnlyRootFilesystem: true}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
2626
| `IMAGE_PROCESSING_CONTAINER_IMAGE` | Custom container image that is used for steps that processes the image. If `IMAGE_PROCESSING_CONTAINER_TEMPLATE` is also specifying an image, then the value for `IMAGE_PROCESSING_CONTAINER_IMAGE` has precedence. |
27-
| `WAITER_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that waits for local source code to be uploaded to it. Default is `{"image":"ghcr.io/shipwright-io/build/waiter:latest", "command": ["/ko-app/waiter"], "args": ["start"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
27+
| `WAITER_CONTAINER_TEMPLATE` | JSON representation of a [Container] template that waits for local source code to be uploaded to it. Default is `{"image":"ghcr.io/shipwright-io/build/waiter:latest", "command": ["/ko-app/waiter"], "args": ["start","--lock-file=/shp-tmp/waiter.lock"], "env": [{"name": "HOME","value": "/shared-home"}], "securityContext":{"allowPrivilegeEscalation": false, "capabilities": {"drop": ["ALL"]}, "runAsUser":1000,"runAsGroup":1000}, readOnlyRootFilesystem: true}`. The following properties are ignored as they are set by the controller: `args`, `name`. |
2828
| `WAITER_CONTAINER_IMAGE` | Custom container image that waits for local source code to be uploaded to it. If `WAITER_IMAGE_CONTAINER_TEMPLATE` is also specifying an image, then the value for `WAITER_IMAGE_CONTAINER_IMAGE` has precedence. |
2929
| `BUILD_CONTROLLER_LEADER_ELECTION_NAMESPACE` | Set the namespace to be used to store the `shipwright-build-controller` lock, by default it is in the same namespace as the controller itself. |
3030
| `BUILD_CONTROLLER_LEASE_DURATION` | Override the `LeaseDuration`, which is the duration that non-leader candidates will wait to force acquire leadership. |

‎pkg/config/config.go‎

Lines changed: 11 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -190,8 +190,9 @@ func NewDefaultConfig() *Config {
190190
"ALL",
191191
},
192192
},
193-
RunAsUser: nonRoot,
194-
RunAsGroup: nonRoot,
193+
RunAsUser: nonRoot,
194+
RunAsGroup: nonRoot,
195+
ReadOnlyRootFilesystem: ptr.To(true),
195196
},
196197
},
197198

@@ -218,8 +219,9 @@ func NewDefaultConfig() *Config {
218219
"ALL",
219220
},
220221
},
221-
RunAsUser: nonRoot,
222-
RunAsGroup: nonRoot,
222+
RunAsUser: nonRoot,
223+
RunAsGroup: nonRoot,
224+
ReadOnlyRootFilesystem: ptr.To(true),
223225
},
224226
},
225227

@@ -244,6 +246,7 @@ func NewDefaultConfig() *Config {
244246
AllowPrivilegeEscalation: ptr.To(false),
245247
RunAsUser: root,
246248
RunAsGroup: root,
249+
ReadOnlyRootFilesystem: ptr.To(true),
247250
Capabilities: &corev1.Capabilities{
248251
Add: []corev1.Capability{
249252
"DAC_OVERRIDE",
@@ -262,6 +265,7 @@ func NewDefaultConfig() *Config {
262265
},
263266
Args: []string{
264267
"start",
268+
"--lock-file=/shp-tmp/waiter.lock", // Sets lock file path to the generated tmp volume to prevent it from using its own filesystem.
265269
},
266270
// This directory is created in the base image as writable for everybody
267271
Env: []corev1.EnvVar{
@@ -277,8 +281,9 @@ func NewDefaultConfig() *Config {
277281
"ALL",
278282
},
279283
},
280-
RunAsUser: nonRoot,
281-
RunAsGroup: nonRoot,
284+
RunAsUser: nonRoot,
285+
RunAsGroup: nonRoot,
286+
ReadOnlyRootFilesystem: ptr.To(true),
282287
},
283288
},
284289

‎pkg/config/config_test.go‎

Lines changed: 7 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -142,8 +142,9 @@ var _ = Describe("Config", func() {
142142
"ALL",
143143
},
144144
},
145-
RunAsUser: nonRoot,
146-
RunAsGroup: nonRoot,
145+
RunAsUser: nonRoot,
146+
RunAsGroup: nonRoot,
147+
ReadOnlyRootFilesystem: ptr.To(true),
147148
},
148149
}))
149150
})
@@ -234,7 +235,7 @@ var _ = Describe("Config", func() {
234235
Expect(config.WaiterContainerTemplate).To(Equal(Step{
235236
Image: "myregistry/custom/image",
236237
Command: []string{"/ko-app/waiter"},
237-
Args: []string{"start"},
238+
Args: []string{"start", "--lock-file=/shp-tmp/waiter.lock"},
238239
Env: []corev1.EnvVar{{Name: "HOME", Value: "/shared-home"}},
239240
SecurityContext: &corev1.SecurityContext{
240241
AllowPrivilegeEscalation: ptr.To(false),
@@ -243,8 +244,9 @@ var _ = Describe("Config", func() {
243244
"ALL",
244245
},
245246
},
246-
RunAsUser: nonRoot,
247-
RunAsGroup: nonRoot,
247+
RunAsUser: nonRoot,
248+
RunAsGroup: nonRoot,
249+
ReadOnlyRootFilesystem: ptr.To(true),
248250
},
249251
}))
250252
})

‎pkg/reconciler/buildrun/resources/sources/local_copy_test.go‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -32,7 +32,7 @@ var _ = Describe("LocalCopy", func() {
3232
Expect(len(taskSpec.Steps)).To(Equal(1))
3333
Expect(taskSpec.Steps[0].Name).To(Equal(sources.WaiterContainerName))
3434
Expect(taskSpec.Steps[0].Image).To(Equal(cfg.WaiterContainerTemplate.Image))
35-
Expect(taskSpec.Steps[0].Args).To(Equal([]string{"start", "--timeout=1m0s"}))
35+
Expect(taskSpec.Steps[0].Args).To(Equal([]string{"start", "--lock-file=/shp-tmp/waiter.lock", "--timeout=1m0s"}))
3636
})
3737
})
3838
})

0 commit comments

Comments
 (0)