diff --git a/Jenkinsfile b/Jenkinsfile index 709730c77..6ada015aa 100644 --- a/Jenkinsfile +++ b/Jenkinsfile @@ -125,7 +125,8 @@ for (int i = 0; i < splits.size(); i++) { def image = skipImageBuild ? docker.image('jenkins/ath') : docker.build('jenkins/ath', '--build-arg uid="$(id -u)" --build-arg gid="$(id -g)" ./src/main/resources/ath-container/') sh 'mkdir -p target/ath-reports && chmod a+rwx target/ath-reports' def cwd = pwd() - image.inside("-v /var/run/docker.sock:/var/run/docker.sock -v '${cwd}/target/ath-reports:/reports:rw' --shm-size 2g") { + def dockergid = sh label: 'get docker group', returnStdout: true, script: 'getent group docker | cut -d: -f3' + image.inside("--group-add ${dockergid} -v /var/run/docker.sock:/var/run/docker.sock -v '${cwd}/target/ath-reports:/reports:rw' --shm-size 2g") { def exclusions = splits.get(index).join('\n') writeFile file: 'excludes.txt', text: exclusions infra.withArtifactCachingProxy { diff --git a/ath-container.sh b/ath-container.sh index 836c21eaf..df015a197 100755 --- a/ath-container.sh +++ b/ath-container.sh @@ -26,6 +26,9 @@ docker build \ "$DIR/src/main/resources/ath-container" \ -t "$tag" +# obtain the groupId to grant to access the docker socket +dockergid=$(docker run --rm -v /var/run/docker.sock:/var/run/docker.sock ubuntu:noble stat -c %g /var/run/docker.sock) + docker run \ --interactive \ --tty \ @@ -34,6 +37,7 @@ docker run \ --user ath-user \ --workdir /home/ath-user/sources \ --shm-size 2g \ + --group-add ${dockergid} \ -v /var/run/docker.sock:/var/run/docker.sock \ -v "$(pwd):/home/ath-user/sources" \ -v "${HOME}/.m2/repository:/home/ath-user/.m2/repository" \ diff --git a/src/main/resources/ath-container/Dockerfile b/src/main/resources/ath-container/Dockerfile index 7cde7566e..ab34cf3c2 100644 --- a/src/main/resources/ath-container/Dockerfile +++ b/src/main/resources/ath-container/Dockerfile @@ -86,11 +86,6 @@ RUN deluser --remove-home ubuntu \ && groupadd ath-user -g $gid \ && useradd ath-user -l -c 'ATH User' -u $uid -g $gid -m -d /home/ath-user -s /bin/bash -# Set SUID and SGID for docker binary so it can communicate with mapped socket its uid:gid we can not control. Alternative -# approach used for this is adding ath-user to the group of /var/run/docker.sock but that require root permission we do not -# have in ENTRYPOINT as the container is started as ath-user. -RUN chmod ug+s /usr/bin/docker* - # Give permission to modify the alternatives links to change the java version in use RUN chmod u+s "$(which update-alternatives)"