[JIRA] (JENKINS-47827) Support passing a user/uid into containerTemplate

Re: Support passing a user/uid into containerTemplate

isn't this possible now with the yaml syntax?

This message was sent by Atlassian JIRA (v7.3.0#73011-sha1:3c73d0e)

ifernandezcalvo@cloudbees.com (JIRA)

unread,

Jun 22, 2018, 10:28:01 AM6/22/18

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

Re: Support passing a user/uid into containerTemplate

The issue is because the JNLP agent container uses UID 10000 and the jenkins uses the UID 1000 and both try to use the same user on the same folders with different UID

 
                                                                def label = "mypod-${UUID.randomUUID().toString()}"
def name = 'jenkins'
timestamps { 
  podTemplate(
    label: label,
    containers: [
      containerTemplate(name: name, image: "jenkins/jenkins", ttyEnabled: true)
    ]){
      node(label) {
        stage('Run on k8s'){
          sh 'id'
          container('jnlp') {
            sh 'id'
          }
          container(name) {
            sh 'id'
          }
        }
      }
    }
} 
                                                            

ifernandezcalvo@cloudbees.com (JIRA)

unread,

Jun 22, 2018, 10:29:01 AM6/22/18

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo edited a comment on

Re: Support passing a user/uid into containerTemplate

The issue is because the JNLP agent container uses UID 10000 and , in this example, the jenkins container uses the UID 1000 and both try to use the same user on the same folders with different UID
{code:java}

def label = "mypod-${UUID.randomUUID().toString()}"
def name = 'jenkins'
timestamps {
  podTemplate(
    label: label,
    containers: [
      containerTemplate(name: name, image: "jenkins/jenkins", ttyEnabled: true)
    ]){
      node(label) {
        stage('Run on k8s'){
          sh 'id'
          container('jnlp') {
            sh 'id'
          }
          container(name) {
            sh 'id'
          }
        }
      }
    }

}{code}

jenkins-ci@carlossanchez.eu (JIRA)

unread,

Jun 22, 2018, 10:31:03 AM6/22/18

to jenkinsc...@googlegroups.com

Carlos Sanchez commented on

Re: Support passing a user/uid into containerTemplate

you can configure the user id using the yaml syntax

https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container

 
                                                                apiVersion: v1
kind: Pod
metadata:
  name: security-context-demo-2
spec:
  securityContext:
    runAsUser: 1000
  containers:
  - name: sec-ctx-demo-2
    image: gcr.io/google-samples/node-hello:1.0
    securityContext:
      runAsUser: 2000
      allowPrivilegeEscalation: false
 
                                                            

jenkins-ci@carlossanchez.eu (JIRA)

unread,

Jun 22, 2018, 10:31:03 AM6/22/18

to jenkinsc...@googlegroups.com

Carlos Sanchez resolved as Not A Defect

Jenkins /

Change By:	Carlos Sanchez
Status:	Open Resolved
Resolution:	Not A Defect

ifernandezcalvo@cloudbees.com (JIRA)

unread,

Jun 22, 2018, 10:49:02 AM6/22/18

to jenkinsc...@googlegroups.com

Ivan Fernandez Calvo commented on

Re: Support passing a user/uid into containerTemplate

The only solution it is to force the UID to 1000 and there is not conflict to access to the share filesystem

def label = "mypod-${UUID.randomUUID().toString()}"

def workspace = "/tmp/jenkins-${UUID.randomUUID().toString()}"
def name = 'jenkins'
def yaml = """
apiVersion: v1
kind: Pod
metadata:
  generateName: jnlp-
  labels:
    name: jnlp
    label: jnlp
spec:
  containers:
    - name: jnlp
    image: jenkins/jnlp-slave
    tty: true
    securityContext:
      runAsUser: 1000
      allowPrivilegeEscalation: false
    - name: jenkins
      image: jenkins/jenkins
      tty: true
      securityContext:
       runAsUser: 1000
       allowPrivilegeEscalation: false
"""
timestamps { 
  podTemplate(label: label, yaml: yaml){
    node(label) {
      sh 'id'
      stage('Run on k8s'){
        container('jnlp') {
          sh 'id'
        }
        container(name) {
          sh 'id'
        }
      }
    }
  }
} 
                                                            

llibicpep@gmail.com (JIRA)

unread,

Jul 11, 2018, 10:31:02 PM7/11/18

to jenkinsc...@googlegroups.com

Dmytro Kryvenko reopened an issue

Why is this resolved? Maybe not a bug but definitely sounds like a feature request. Jenkins official slave docker image use jenkins user with uid 10000, where most of the alpine based images on the market use root with uid 1000, which means anything created in Jenkinsfile by directives such as `writeFile` becomes unusable by other containers in the pod. Sounds pretty serious to me.

It's good to have an ability to fall back to the yml and have a workaround there, but more fundamental and transparent to the users solution is a must.

Jenkins /

Change By:	Dmytro Kryvenko
Resolution:	Not A Defect
Status:	Resolved Reopened

This message was sent by Atlassian JIRA (v7.10.1#710002-sha1:6efc396)

jenkins-ci@carlossanchez.eu (JIRA)

unread,

Jul 12, 2018, 2:31:02 AM7/12/18

to jenkinsc...@googlegroups.com

Carlos Sanchez updated

Support passing a user/uid into containerTemplate => it is supported using yaml syntax, will not add new features to containerTemplate

Jenkins /

Change By:	Carlos Sanchez
Status:	Reopened Fixed but Unreleased
Resolution:	Won't Do

jenkins-ci@carlossanchez.eu (JIRA)

unread,

Jul 12, 2018, 2:31:03 AM7/12/18

to jenkinsc...@googlegroups.com

Carlos Sanchez updated

Jenkins /

Change By:	Carlos Sanchez
Status:	Fixed but Unreleased Resolved

jonesbusy@gmail.com (JIRA)

unread,

Feb 9, 2019, 7:59:09 AM2/9/19

to jenkinsc...@googlegroups.com

Valentin Delaye commented on

Re: Support passing a user/uid into containerTemplate

Why not supporting passing the runAsUser throught the containerTemplate ? It would be very useful for many and easier to maintain instead of YAML files..

This message was sent by Atlassian Jira (v7.11.2#711002-sha1:fdc329d)

jenkins-ci@carlossanchez.eu (JIRA)

unread,

Feb 11, 2019, 5:09:04 AM2/11/19

to jenkinsc...@googlegroups.com

Carlos Sanchez commented on

Re: Support passing a user/uid into containerTemplate

Feel free to open a PR

ivan.martinez.rodriguez@ericsson.com (JIRA)

unread,

Mar 28, 2019, 1:11:02 PM3/28/19

to jenkinsc...@googlegroups.com

Ivan Martinez commented on

Re: Support passing a user/uid into containerTemplate

I agree with other users it would be quite helpful to add support through containerTemplate.

cochise.ruhulessin@wizardsofindustry.com (JIRA)

unread,

Jun 11, 2019, 3:41:02 PM6/11/19

to jenkinsc...@googlegroups.com

Cochise Ruhulessin commented on

Re: Support passing a user/uid into containerTemplate

The suggested solution does not work for Pod templates that are created through Groovy init scripts.

cochise.ruhulessin@wizardsofindustry.com (JIRA)

unread,

Jun 11, 2019, 3:42:02 PM6/11/19

to jenkinsc...@googlegroups.com

Cochise Ruhulessin updated an issue

Jenkins /

Comment:
Change By:	Cochise Ruhulessin

The suggested solution does not work for Pod templates that are created through Groovy init scripts.

cochise.ruhulessin@wizardsofindustry.com (JIRA)

unread,

Jun 11, 2019, 3:44:03 PM6/11/19

to jenkinsc...@googlegroups.com

Cochise Ruhulessin updated

Jenkins /

Change By:	Cochise Ruhulessin
Resolution:	Won't Do
Status:	Resolved In Review

cochise.ruhulessin@wizardsofindustry.com (JIRA)

unread,

Jun 11, 2019, 3:44:03 PM6/11/19

to jenkinsc...@googlegroups.com

Cochise Ruhulessin updated

Jenkins /

Change By:	Cochise Ruhulessin
Status:	In Review Progress

ashok.mohanty@oracle.com (JIRA)

unread,

Jul 10, 2019, 6:45:02 AM7/10/19

to jenkinsc...@googlegroups.com

ASHOK MOHANTY commented on

Re: Support passing a user/uid into containerTemplate

Thanks, any update when can we expect the fix !!

jonesbusy@gmail.com (JIRA)

unread,

Jul 12, 2019, 6:12:02 AM7/12/19

to jenkinsc...@googlegroups.com

Valentin Delaye commented on

Re: Support passing a user/uid into containerTemplate

Ohhh so cool to see it's in progress

elhayefrat@gmail.com (JIRA)

unread,

Aug 25, 2019, 9:56:02 AM8/25/19

to jenkinsc...@googlegroups.com

elhay efrat commented on

Re: Support passing a user/uid into containerTemplate

Guys can you please approve [JENKINS-47827 ] adding support Support passing a user/uid into containerTemplate

jenkins-ci@carlossanchez.eu (JIRA)

unread,

Aug 25, 2019, 2:22:03 PM8/25/19

to jenkinsc...@googlegroups.com

Carlos Sanchez assigned an issue to Unassigned

Jenkins /

Change By:	Carlos Sanchez
Assignee:	Carlos Sanchez

jglick@cloudbees.com (JIRA)

unread,

Aug 25, 2019, 2:22:05 PM8/25/19

to jenkinsc...@googlegroups.com

Jesse Glick assigned an issue to elhay efrat

Jenkins /

Change By:	Jesse Glick
Assignee:	elhay efrat

jglick@cloudbees.com (JIRA)

unread,

Aug 25, 2019, 2:23:04 PM8/25/19

to jenkinsc...@googlegroups.com

Jesse Glick updated

Jenkins /

Change By:	Jesse Glick
Status:	In Progress Review

elhayefrat@gmail.com (JIRA)

unread,

Aug 27, 2019, 6:12:04 AM8/27/19

to jenkinsc...@googlegroups.com

elhay efrat updated

Waiting for code review and merge no conflicts and test covered and pass

Jenkins /

Change By:	elhay efrat
Status:	In Review Resolved
Resolution:	Fixed
Released As:	Fixed

elhayefrat@gmail.com (JIRA)

unread,

Aug 28, 2019, 2:02:03 AM8/28/19

to jenkinsc...@googlegroups.com

elhay efrat commented on