Re: [Kubernetes Plugin] specifying shell in containerTemplate() has no effect in job

[Carlos Sanchez]

Have you seen the kaniko example ?

https://blog.csanchez.org/2018/06/13/building-docker-images-without-docker/

On Fri, Jul 6, 2018, 21:55 Dave Schile <bajac...@gmail.com> wrote:

I'm running kubernetes plugin 1.9.2 with Jenkins 2.107.3

I specify a container template like this:

containerTemplate(name: 'kaniko', image: 'gitlab-registry.nordstrom.com/cicd/kaniko:0.0.1', shell: '/bin/busybox sh', ttyEnabled: true),

This container has no /bin/sh installed at all.  It uses busybox and cannot have the /bin/sh symlink due to limitations of Kaniko

When running a `sh` command in the pipeline, I get:

rpc error: code = 13 desc = invalid header field value "oci runtime error: exec failed: container_linux.go:247: starting container process caused \"exec: \\\"/bin/sh\\\": stat /bin/sh: no such file or directory\"\n"

Anyone know where you can modify the exec command that the plugin uses to run shell commands?  The docs at https://github.com/jenkinsci/kubernetes-plugin#specifying-a-different-shell-command-other-than-binsh seem to say this is possible.  FYI, the shell property of containerTemplate is not mentioned in the overview of containerTemplate in the docs.

Thank you,

David

--
You received this message because you are subscribed to the Google Groups "Jenkins Users" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jenkinsci-use...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/23c96b2a-bca6-4064-a95d-96c77ea940f7%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[Dave Schile]

Carlos, 
Thanks for that.  I hadn't seen it, and it's a huge help.  Can you give me a little more insight RE your comment on the blog where you say "Still not secure" as a `con` of Koniko? 

David.

[Carlos Sanchez]

as noted in the blog post, just follow the link for the discussion from Jessie Frazelle

This solution is still not safe, as containers run as root, 

To view this discussion on the web visit https://groups.google.com/d/msgid/jenkinsci-users/464a9617-aa28-409e-b3be-84dc7a62cbed%40googlegroups.com.