Jenkins Pipeline - 在 docker 权限问题中执行作业

Question

我有一个 Jenkinsfile，看起来像

pipeline {
    agent {
        docker {
            image 'myartifactory/cloud-eng/sls-build:0.13'
            label 'docker'
            registryUrl 'https://myartifactory'
            registryCredentialsId 'artfifactory-cred-id'
        }
    }

    environment {
    }
    stages {
        stage('Test') {
            sh "env | sort"
            sh "make setup-ci"
            sh "make test"
        }
    }
}

当我运行它时，我看到 jenkins 执行了如下命令：

docker run -t -d -u 1318244366:1318464184 -w /jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https -v /jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https:/jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https:rw,z -v /jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https@tmp:/jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https@tmp:rw,z -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ********  myartifactory/cloud-eng/sls-build:0.13 cat

本项目使用 python、NPM 和无服务器框架 (javascript)。

如果我像上面那样运行它会失败

 npm ERR! correctMkdir failed to make directory /.npm/_locks
2021-03-11 16:17:02  npm ERR! code EACCES
2021-03-11 16:17:02  npm ERR! syscall mkdir
2021-03-11 16:17:02  npm ERR! path /.npm
2021-03-11 16:17:02  npm ERR! errno -13
2021-03-11 16:17:02  npm ERR! 
2021-03-11 16:17:02  npm ERR! Your cache folder contains root-owned files, due to a bug in
2021-03-11 16:17:02  npm ERR! previous versions of npm which has since been addressed.
2021-03-11 16:17:02  npm ERR! 
2021-03-11 16:17:02  npm ERR! To permanently fix this problem, please run:
2021-03-11 16:17:02  npm ERR!   sudo chown -R 1318244366:1318464184 "/.npm"
2021-03-11 16:17:02  make: *** [setup-ci] Error 243

我尝试了许多解决方案，但都取得了不同程度的成功。如果我添加这个： args '-u root' 到 docker 部分，它的工作原理当然是 root 对所有内容都有权限......但是安全性不会喜欢以 root 身份运行 docker 容器。

无论我如何在 environment or args 中覆盖 $HOME，更改用户我总是会遇到 NPM 或 python 的权限问题。

我遇到的各种 hack 的其他错误，例如 args '-e HOME=/tmp -e NPM_CONFIG_PREFIX=/tmp/.npm'

../../../../../tmp/.local/share/virtualenvs/te_csoe-1624-switch-shared-https-y_ilovXz/lib/python3.8/site-packages/_pytest/cacheprovider.py:428
2021-03-11 14:45:14    /tmp/.local/share/virtualenvs/te_csoe-1624-switch-shared-https-y_ilovXz/lib/python3.8/site-packages/_pytest/cacheprovider.py:428: PytestCacheWarning: cache could not write path /jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https/.pytest_cache/v/cache/nodeids
2021-03-11 14:45:14      config.cache.set("cache/nodeids", sorted(self.cached_nodeids))

Error: EACCES: permission denied, unlink '/jenkins_home/jenkins-rh7-a01/8b13f8c3/workspace/te_csoe-1624-switch-shared-https/.serverless/cloudformation-template-update-stack.json'
2021-03-11 14:45:19        at Object.unlinkSync (fs.js:1136:3)

由于 jenkins 挂载随机目录以共享和随机用户，我不确定如何修改 Dockerfile 以授予图像写入权限....

有谁知道如何正确获取权限？

编辑添加 Dockerfile

FROM amazonlinux:2

RUN yum install -y amazon-linux-extras
RUN yum install -y unzip
RUN yum groupinstall -y "Development Tools"
RUN yum install vim-enhanced -y

# install python/pipenv
ENV PYTHON_VERSION=3.9
RUN amazon-linux-extras install python${PYTHON_VERSION}
RUN /bin/pip-${PYTHON_VERSION} install pipenv

# install node/npm
RUN curl -sL https://rpm.nodesource.com/setup_12.x | bash -
RUN yum install -y nodejs
RUN mkdir /tmp/node-cache
RUN npm config set cache /tmp/node-cache --global

# install aws-cli2
RUN curl "https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip" -o "awscliv2.zip" && \
    unzip awscliv2.zip && \
    ./aws/install && \
    rm -rf awscliv2.zip
`
# install vault client
ENV VAULT_VERSION=1.5.4
RUN curl -sSLo /tmp/vault.zip https://releases.hashicorp.com/vault/$VAULT_VERSION/vault_${VAULT_VERSION}_linux_amd64.zip && \
    unzip -d /bin /tmp/vault.zip && \
    rm -rf /tmp/vault.zip && \
    setcap cap_ipc_lock= /bin/vault



ADD ./aws-login.sh /usr/local/bin/aws-login.sh
ADD ./ghe-token.sh /usr/local/bin/ghe-token.sh
ENV PATH="/bin:${PATH}"
# indicates CI CONTAINER so processes can check if running in CI
ENV CI_CONTAINER=1
ENV LANG="en_US.UTF-8"
ENV TERM xterm
# avoid million NPM install messages
ENV npm_config_loglevel warn
ENTRYPOINT []

Answer 1

让我绊倒的事情是我多次以-u root 运行它，而我只有一个代理（不要问），并且 jenkins 缓存了工作区目录。因此，以 root 身份运行的 docker 容器在该代码中更改了文件权限。因此，当我摆脱 -u root 并开始使用 jenkins 用户时，它对某些文件和目录没有权限。

解决方案是删除工作区并确保所有 make 调用在任何命令之前都有一个 export HOME=${WORKSPACE}。

可能有更好的方法来导出 HOME 但这解决了问题