Skip to content

Commit b87e418

Browse files
hasanawad94hasanawad94
committed
add readOnlyFsConfig and volumes to buildstrategies
Signed-off-by: Hasan Awad <[email protected]>
1 parent de53278 commit b87e418

File tree

5 files changed

+134
-12
lines changed

5 files changed

+134
-12
lines changed

‎samples/v1beta1/buildstrategy/buildah/buildstrategy_buildah_shipwright_managed_push_cr.yaml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,17 @@ spec:
1111
workingDir: $(params.shp-source-root)
1212
securityContext:
1313
privileged: true
14+
readOnlyRootFilesystem: true
15+
volumeMounts:
16+
- name: shp-buildah-container-storage
17+
mountPath: /var/lib/containers # Read/Write location of container storage
18+
- name: shp-tmp
19+
mountPath: /shp-tmp
20+
- name: shp-run
21+
mountPath: /var/run
22+
env:
23+
- name: TMPDIR
24+
value: /shp-tmp
1425
command:
1526
- /bin/bash
1627
args:
@@ -125,21 +136,21 @@ spec:
125136
126137
echo "[INFO] Creating registries config file..."
127138
if [ "${registriesSearch}" != "" ]; then
128-
cat <<EOF >>/tmp/registries.conf
139+
cat <<EOF >>/shp-tmp/registries.conf
129140
[registries.search]
130141
registries = [${registriesSearch::-2}]
131142
132143
EOF
133144
fi
134145
if [ "${registriesInsecure}" != "" ]; then
135-
cat <<EOF >>/tmp/registries.conf
146+
cat <<EOF >>/shp-tmp/registries.conf
136147
[registries.insecure]
137148
registries = [${registriesInsecure::-2}]
138149
139150
EOF
140151
fi
141152
if [ "${registriesBlock}" != "" ]; then
142-
cat <<EOF >>/tmp/registries.conf
153+
cat <<EOF >>/shp-tmp/registries.conf
143154
[registries.block]
144155
registries = [${registriesBlock::-2}]
145156
@@ -150,7 +161,7 @@ spec:
150161
echo "[INFO] Building image ${image}"
151162
buildah --storage-driver=$(params.storage-driver) \
152163
bud "${budArgs[@]}" \
153-
--registries-conf=/tmp/registries.conf \
164+
--registries-conf=/shp-tmp/registries.conf \
154165
--tag="${image}" \
155166
--file="${dockerfile}" \
156167
.
@@ -219,6 +230,13 @@ spec:
219230
description: "Sets the target stage to be built."
220231
type: string
221232
default: ""
233+
volumes:
234+
- name: shp-buildah-container-storage
235+
emptyDir: {}
236+
- name: shp-tmp
237+
emptyDir: {}
238+
- name: shp-run
239+
emptyDir: {}
222240
securityContext:
223241
runAsUser: 0
224242
runAsGroup: 0

‎samples/v1beta1/buildstrategy/buildah/buildstrategy_buildah_strategy_managed_push_cr.yaml‎

Lines changed: 22 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -10,9 +10,20 @@ spec:
1010
imagePullPolicy: Always
1111
workingDir: $(params.shp-source-root)
1212
securityContext:
13+
readOnlyRootFilesystem: true
1314
capabilities:
1415
add:
1516
- "SETFCAP"
17+
volumeMounts:
18+
- name: shp-buildah-container-storage
19+
mountPath: /var/lib/containers # Read/Write location of container storage
20+
- name: shp-tmp
21+
mountPath: /shp-tmp
22+
- name: shp-run
23+
mountPath: /var/run
24+
env:
25+
- name: TMPDIR
26+
value: /shp-tmp
1627
command:
1728
- /bin/bash
1829
args:
@@ -125,21 +136,21 @@ spec:
125136
126137
echo "[INFO] Creating registries config file..."
127138
if [ "${registriesSearch}" != "" ]; then
128-
cat <<EOF >>/tmp/registries.conf
139+
cat <<EOF >>/shp-tmp/registries.conf
129140
[registries.search]
130141
registries = [${registriesSearch::-2}]
131142
132143
EOF
133144
fi
134145
if [ "${registriesInsecure}" != "" ]; then
135-
cat <<EOF >>/tmp/registries.conf
146+
cat <<EOF >>/shp-tmp/registries.conf
136147
[registries.insecure]
137148
registries = [${registriesInsecure::-2}]
138149
139150
EOF
140151
fi
141152
if [ "${registriesBlock}" != "" ]; then
142-
cat <<EOF >>/tmp/registries.conf
153+
cat <<EOF >>/shp-tmp/registries.conf
143154
[registries.block]
144155
registries = [${registriesBlock::-2}]
145156
@@ -150,7 +161,7 @@ spec:
150161
echo "[INFO] Building image ${image}"
151162
buildah --storage-driver=$(params.storage-driver) \
152163
bud "${budArgs[@]}" \
153-
--registries-conf=/tmp/registries.conf \
164+
--registries-conf=/shp-tmp/registries.conf \
154165
--tag="${image}" \
155166
--file="${dockerfile}" \
156167
.
@@ -222,3 +233,10 @@ spec:
222233
securityContext:
223234
runAsUser: 0
224235
runAsGroup: 0
236+
volumes:
237+
- name: shp-buildah-container-storage
238+
emptyDir: {}
239+
- name: shp-tmp
240+
emptyDir: {}
241+
- name: shp-run
242+
emptyDir: {}

‎samples/v1beta1/buildstrategy/buildkit/buildstrategy_buildkit_cr.yaml‎

Lines changed: 21 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,15 +37,21 @@ spec:
3737
image: moby/buildkit:v0.25.1-rootless
3838
imagePullPolicy: Always
3939
securityContext:
40-
allowPrivilegeEscalation: true
4140
capabilities:
4241
add:
4342
- SETGID
4443
- SETUID
4544
seccompProfile:
4645
type: Unconfined
46+
readOnlyRootFilesystem: true
47+
runAsUser: 1000
48+
runAsGroup: 1000
4749
workingDir: $(params.shp-source-root)
4850
env:
51+
# This is required to align the temporary directory created by buildkit
52+
# with the volume mount for that directory.
53+
- name: XDG_RUNTIME_DIR
54+
value: /home/user/.local/tmp
4955
- name: DOCKER_CONFIG
5056
value: /tekton/home/.docker
5157
- name: HOME
@@ -67,6 +73,13 @@ spec:
6773
value: $(params.cache)
6874
- name: PARAM_TARGET
6975
value: $(params.target)
76+
volumeMounts:
77+
- name: buildkitd-1
78+
mountPath: /home/user/.local/share/buildkit
79+
- name: buildkitd-2
80+
mountPath: /home/user/.local/tmp
81+
- name: shp-tmp
82+
mountPath: /tmp
7083
command:
7184
- /bin/ash
7285
args:
@@ -180,3 +193,10 @@ spec:
180193
securityContext:
181194
runAsUser: 1000
182195
runAsGroup: 1000
196+
volumes:
197+
- name: shp-tmp
198+
emptyDir: {}
199+
- name: buildkitd-1
200+
emptyDir: {}
201+
- name: buildkitd-2
202+
emptyDir: {}

‎samples/v1beta1/buildstrategy/ko/buildstrategy_ko_cr.yaml‎

Lines changed: 16 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -25,15 +25,24 @@ spec:
2525
description: "Volume to contain the GOCACHE. Can be set to a persistent volume to optimize compilation performance for rebuilds."
2626
overridable: true
2727
emptyDir: {}
28+
- name: ko-tmp
29+
description: "Volume to contain temporary files for ko binary and other build artifacts."
30+
overridable: true
31+
emptyDir: {}
2832
steps:
2933
- name: build
3034
image: golang:$(params.go-version)
3135
imagePullPolicy: Always
3236
workingDir: $(params.shp-source-root)
37+
securityContext:
38+
readOnlyRootFilesystem: true
3339
volumeMounts:
3440
- mountPath: /gocache
3541
name: gocache
3642
readOnly: false
43+
- mountPath: /ko-tmp
44+
name: ko-tmp
45+
readOnly: false
3746
env:
3847
- name: DOCKER_CONFIG
3948
value: /tekton/home/.docker
@@ -43,6 +52,10 @@ spec:
4352
value: $(params.go-flags)
4453
- name: GOCACHE
4554
value: /gocache
55+
- name: GOTMPDIR
56+
value: /ko-tmp
57+
- name: TMPDIR
58+
value: /ko-tmp
4659
- name: PARAM_OUTPUT_IMAGE
4760
value: $(params.shp-output-image)
4861
- name: PARAM_OUTPUT_DIRECTORY
@@ -80,7 +93,7 @@ spec:
8093
fi
8194
8295
# Download ko to the temp directory
83-
curl -f -s -L "https://github.com/ko-build/ko/releases/download/${KO_VERSION_WITH_V}/ko_${KO_VERSION_WITHOUT_V}_$(uname)_$(uname -m | sed 's/aarch64/arm64/').tar.gz" | tar xzf - -C /tmp ko
96+
curl -f -s -L "https://github.com/ko-build/ko/releases/download/${KO_VERSION_WITH_V}/ko_${KO_VERSION_WITHOUT_V}_$(uname)_$(uname -m | sed 's/aarch64/arm64/').tar.gz" | tar xzf - -C /ko-tmp ko
8497
8598
# Determine the platform
8699
PLATFORM="${PARAM_TARGET_PLATFORM}"
@@ -90,7 +103,7 @@ spec:
90103
91104
# Print version information
92105
go version
93-
echo "ko version $(/tmp/ko version)"
106+
echo "ko version $(/ko-tmp/ko version)"
94107
95108
# Allow directory to be owned by other user which is normal for a volume-mounted directory.
96109
# This allows Go to run git commands to access repository metadata.
@@ -102,7 +115,7 @@ spec:
102115
export GOROOT="$(go env GOROOT)"
103116
104117
pushd "${PARAM_SOURCE_CONTEXT}" > /dev/null
105-
/tmp/ko build "${PARAM_PACKAGE_DIRECTORY}" --oci-layout-path="${PARAM_OUTPUT_DIRECTORY}" --platform="${PLATFORM}" --push=false
118+
/ko-tmp/ko build "${PARAM_PACKAGE_DIRECTORY}" --oci-layout-path="${PARAM_OUTPUT_DIRECTORY}" --platform="${PLATFORM}" --push=false
106119
popd > /dev/null
107120
resources:
108121
limits:

‎samples/v1beta1/buildstrategy/multiarch-native-buildah/buildstrategy_multiarch_native_buildah_cr.yaml‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -10,13 +10,25 @@ spec:
1010
overridable: true
1111
- name: additional-bins
1212
emptyDir: {}
13+
- name: tmp
14+
emptyDir: {}
15+
- name: run
16+
emptyDir: {}
17+
- name: buildah-storage
18+
emptyDir: {}
1319
steps:
1420
- name: prepare-build
1521
image: quay.io/centos/centos:stream9
1622
workingDir: $(params.shp-source-root)
23+
securityContext:
24+
readOnlyRootFilesystem: true
1725
volumeMounts:
1826
- mountPath: /usr/local/bin
1927
name: additional-bins
28+
- mountPath: /tmp
29+
name: tmp
30+
- mountPath: /run
31+
name: run
2032
resources:
2133
requests:
2234
cpu: 100m
@@ -198,8 +210,22 @@ spec:
198210
volumeMounts:
199211
- mountPath: /var/workdir
200212
name: workdir
213+
# Temporary directories - all use buildah-temp volume
214+
- mountPath: /tmp
215+
name: buildah-temp
216+
- mountPath: /var/tmp
217+
name: buildah-temp
218+
- mountPath: /var/cache
219+
name: buildah-temp
220+
# Runtime directory
221+
- mountPath: /run
222+
name: buildah-run
223+
# Buildah storage
224+
- mountPath: /var/lib/containers
225+
name: buildah-storage
201226
securityContext:
202227
privileged: true
228+
readOnlyRootFilesystem: true
203229
command:
204230
- bash
205231
resources:
@@ -243,6 +269,12 @@ spec:
243269
volumes:
244270
- name: workdir
245271
emptyDir: {}
272+
- name: buildah-temp
273+
emptyDir: {}
274+
- name: buildah-run
275+
emptyDir: {}
276+
- name: buildah-storage
277+
emptyDir: {}
246278
EOF
247279
done
248280
@@ -331,11 +363,17 @@ spec:
331363
- name: wait-manifests-complete
332364
image: quay.io/centos/centos:stream9
333365
workingDir: /tmp
366+
securityContext:
367+
readOnlyRootFilesystem: true
334368
volumeMounts:
335369
- mountPath: /var/oci-archive-storage
336370
name: oci-archive-storage
337371
- mountPath: /usr/local/bin
338372
name: additional-bins
373+
- mountPath: /tmp
374+
name: tmp
375+
- mountPath: /run
376+
name: run
339377
resources:
340378
requests:
341379
cpu: 50m
@@ -415,6 +453,7 @@ spec:
415453
image: quay.io/containers/buildah:v1.41.5
416454
securityContext:
417455
privileged: true
456+
readOnlyRootFilesystem: true
418457
workingDir: /var/oci-archive-storage
419458
resources:
420459
requests:
@@ -423,8 +462,22 @@ spec:
423462
limits:
424463
memory: 256Mi
425464
volumeMounts:
465+
# Image archive storage
426466
- mountPath: /var/oci-archive-storage
427467
name: oci-archive-storage
468+
# Temporary directories - all use tmp volume
469+
- mountPath: /tmp
470+
name: tmp
471+
- mountPath: /var/tmp
472+
name: tmp
473+
- mountPath: /var/cache
474+
name: tmp
475+
# Runtime directory
476+
- mountPath: /run
477+
name: run
478+
# Buildah storage
479+
- mountPath: /var/lib/containers
480+
name: buildah-storage
428481
command:
429482
- bash
430483
args:

0 commit comments

Comments
 (0)