Skip to content

Commit 95458d0

Browse files
hasanawad94hasanawad94
committed
add readOnlyFsConfig and volumes to buildstrategies
added a separate multi-arch buildah strategy that enables readOnlyRootFilesystem Signed-off-by: Hasan Awad <[email protected]>
1 parent de53278 commit 95458d0

File tree

4 files changed

+81
-12
lines changed

4 files changed

+81
-12
lines changed

‎samples/v1beta1/buildstrategy/buildah/buildstrategy_buildah_shipwright_managed_push_cr.yaml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@ spec:
1111
workingDir: $(params.shp-source-root)
1212
securityContext:
1313
privileged: true
14+
readOnlyRootFilesystem: true
15+
volumeMounts:
16+
- name: shp-buildah-container-storage
17+
mountPath: /var/lib/containers # Read/Write location of container storage
18+
- name: shp-tmp
19+
mountPath: /shp-tmp
20+
- name: shp-run
21+
mountPath: /var/run
22+
env:
23+
- name: TMPDIR
24+
value: /shp-tmp
1425
command:
1526
- /bin/bash
1627
args:
@@ -125,21 +136,21 @@ spec:
125136
126137
echo "[INFO] Creating registries config file..."
127138
if [ "${registriesSearch}" != "" ]; then
128-
cat <<EOF >>/tmp/registries.conf
139+
cat <<EOF >>/shp-tmp/registries.conf
129140
[registries.search]
130141
registries = [${registriesSearch::-2}]
131142
132143
EOF
133144
fi
134145
if [ "${registriesInsecure}" != "" ]; then
135-
cat <<EOF >>/tmp/registries.conf
146+
cat <<EOF >>/shp-tmp/registries.conf
136147
[registries.insecure]
137148
registries = [${registriesInsecure::-2}]
138149
139150
EOF
140151
fi
141152
if [ "${registriesBlock}" != "" ]; then
142-
cat <<EOF >>/tmp/registries.conf
153+
cat <<EOF >>/shp-tmp/registries.conf
143154
[registries.block]
144155
registries = [${registriesBlock::-2}]
145156
@@ -150,7 +161,7 @@ spec:
150161
echo "[INFO] Building image ${image}"
151162
buildah --storage-driver=$(params.storage-driver) \
152163
bud "${budArgs[@]}" \
153-
--registries-conf=/tmp/registries.conf \
164+
--registries-conf=/shp-tmp/registries.conf \
154165
--tag="${image}" \
155166
--file="${dockerfile}" \
156167
.
@@ -219,6 +230,13 @@ spec:
219230
description: "Sets the target stage to be built."
220231
type: string
221232
default: ""
233+
volumes:
234+
- name: shp-buildah-container-storage
235+
emptyDir: {}
236+
- name: shp-tmp
237+
emptyDir: {}
238+
- name: shp-run
239+
emptyDir: {}
222240
securityContext:
223241
runAsUser: 0
224242
runAsGroup: 0

‎samples/v1beta1/buildstrategy/buildah/buildstrategy_buildah_strategy_managed_push_cr.yaml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,20 @@ spec:
1010
imagePullPolicy: Always
1111
workingDir: $(params.shp-source-root)
1212
securityContext:
13+
readOnlyRootFilesystem: true
1314
capabilities:
1415
add:
1516
- "SETFCAP"
17+
volumeMounts:
18+
- name: shp-buildah-container-storage
19+
mountPath: /var/lib/containers # Read/Write location of container storage
20+
- name: shp-tmp
21+
mountPath: /shp-tmp
22+
- name: shp-run
23+
mountPath: /var/run
24+
env:
25+
- name: TMPDIR
26+
value: /shp-tmp
1627
command:
1728
- /bin/bash
1829
args:
@@ -125,21 +136,21 @@ spec:
125136
126137
echo "[INFO] Creating registries config file..."
127138
if [ "${registriesSearch}" != "" ]; then
128-
cat <<EOF >>/tmp/registries.conf
139+
cat <<EOF >>/shp-tmp/registries.conf
129140
[registries.search]
130141
registries = [${registriesSearch::-2}]
131142
132143
EOF
133144
fi
134145
if [ "${registriesInsecure}" != "" ]; then
135-
cat <<EOF >>/tmp/registries.conf
146+
cat <<EOF >>/shp-tmp/registries.conf
136147
[registries.insecure]
137148
registries = [${registriesInsecure::-2}]
138149
139150
EOF
140151
fi
141152
if [ "${registriesBlock}" != "" ]; then
142-
cat <<EOF >>/tmp/registries.conf
153+
cat <<EOF >>/shp-tmp/registries.conf
143154
[registries.block]
144155
registries = [${registriesBlock::-2}]
145156
@@ -150,7 +161,7 @@ spec:
150161
echo "[INFO] Building image ${image}"
151162
buildah --storage-driver=$(params.storage-driver) \
152163
bud "${budArgs[@]}" \
153-
--registries-conf=/tmp/registries.conf \
164+
--registries-conf=/shp-tmp/registries.conf \
154165
--tag="${image}" \
155166
--file="${dockerfile}" \
156167
.
@@ -222,3 +233,10 @@ spec:
222233
securityContext:
223234
runAsUser: 0
224235
runAsGroup: 0
236+
volumes:
237+
- name: shp-buildah-container-storage
238+
emptyDir: {}
239+
- name: shp-tmp
240+
emptyDir: {}
241+
- name: shp-run
242+
emptyDir: {}

‎samples/v1beta1/buildstrategy/buildkit/buildstrategy_buildkit_cr.yaml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,21 @@ spec:
3737
image: moby/buildkit:v0.25.1-rootless
3838
imagePullPolicy: Always
3939
securityContext:
40-
allowPrivilegeEscalation: true
4140
capabilities:
4241
add:
4342
- SETGID
4443
- SETUID
4544
seccompProfile:
4645
type: Unconfined
46+
readOnlyRootFilesystem: true
47+
runAsUser: 1000
48+
runAsGroup: 1000
4749
workingDir: $(params.shp-source-root)
4850
env:
51+
# This is required to align the temporary directory created by buildkit
52+
# with the volume mount for that directory.
53+
- name: XDG_RUNTIME_DIR
54+
value: /home/user/.local/tmp
4955
- name: DOCKER_CONFIG
5056
value: /tekton/home/.docker
5157
- name: HOME
@@ -67,6 +73,13 @@ spec:
6773
value: $(params.cache)
6874
- name: PARAM_TARGET
6975
value: $(params.target)
76+
volumeMounts:
77+
- name: buildkitd-1
78+
mountPath: /home/user/.local/share/buildkit
79+
- name: buildkitd-2
80+
mountPath: /home/user/.local/tmp
81+
- name: shp-tmp
82+
mountPath: /tmp
7083
command:
7184
- /bin/ash
7285
args:
@@ -180,3 +193,10 @@ spec:
180193
securityContext:
181194
runAsUser: 1000
182195
runAsGroup: 1000
196+
volumes:
197+
- name: shp-tmp
198+
emptyDir: {}
199+
- name: buildkitd-1
200+
emptyDir: {}
201+
- name: buildkitd-2
202+
emptyDir: {}

‎samples/v1beta1/buildstrategy/ko/buildstrategy_ko_cr.yaml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,24 @@ spec:
2525
description: "Volume to contain the GOCACHE. Can be set to a persistent volume to optimize compilation performance for rebuilds."
2626
overridable: true
2727
emptyDir: {}
28+
- name: ko-tmp
29+
description: "Volume to contain temporary files for ko binary and other build artifacts."
30+
overridable: true
31+
emptyDir: {}
2832
steps:
2933
- name: build
3034
image: golang:$(params.go-version)
3135
imagePullPolicy: Always
3236
workingDir: $(params.shp-source-root)
37+
securityContext:
38+
readOnlyRootFilesystem: true
3339
volumeMounts:
3440
- mountPath: /gocache
3541
name: gocache
3642
readOnly: false
43+
- mountPath: /ko-tmp
44+
name: ko-tmp
45+
readOnly: false
3746
env:
3847
- name: DOCKER_CONFIG
3948
value: /tekton/home/.docker
@@ -43,6 +52,10 @@ spec:
4352
value: $(params.go-flags)
4453
- name: GOCACHE
4554
value: /gocache
55+
- name: GOTMPDIR
56+
value: /ko-tmp
57+
- name: TMPDIR
58+
value: /ko-tmp
4659
- name: PARAM_OUTPUT_IMAGE
4760
value: $(params.shp-output-image)
4861
- name: PARAM_OUTPUT_DIRECTORY
@@ -80,7 +93,7 @@ spec:
8093
fi
8194
8295
# Download ko to the temp directory
83-
curl -f -s -L "https://github.com/ko-build/ko/releases/download/${KO_VERSION_WITH_V}/ko_${KO_VERSION_WITHOUT_V}_$(uname)_$(uname -m | sed 's/aarch64/arm64/').tar.gz" | tar xzf - -C /tmp ko
96+
curl -f -s -L "https://github.com/ko-build/ko/releases/download/${KO_VERSION_WITH_V}/ko_${KO_VERSION_WITHOUT_V}_$(uname)_$(uname -m | sed 's/aarch64/arm64/').tar.gz" | tar xzf - -C /ko-tmp ko
8497
8598
# Determine the platform
8699
PLATFORM="${PARAM_TARGET_PLATFORM}"
@@ -90,7 +103,7 @@ spec:
90103
91104
# Print version information
92105
go version
93-
echo "ko version $(/tmp/ko version)"
106+
echo "ko version $(/ko-tmp/ko version)"
94107
95108
# Allow directory to be owned by other user which is normal for a volume-mounted directory.
96109
# This allows Go to run git commands to access repository metadata.
@@ -102,7 +115,7 @@ spec:
102115
export GOROOT="$(go env GOROOT)"
103116
104117
pushd "${PARAM_SOURCE_CONTEXT}" > /dev/null
105-
/tmp/ko build "${PARAM_PACKAGE_DIRECTORY}" --oci-layout-path="${PARAM_OUTPUT_DIRECTORY}" --platform="${PLATFORM}" --push=false
118+
/ko-tmp/ko build "${PARAM_PACKAGE_DIRECTORY}" --oci-layout-path="${PARAM_OUTPUT_DIRECTORY}" --platform="${PLATFORM}" --push=false
106119
popd > /dev/null
107120
resources:
108121
limits:

0 commit comments

Comments
 (0)