Add a Dockerfile that adds a non-root user to alpine/git base #408
Conversation
tekton-robot
added
the
size/S
|
This PR cannot be merged: expecting exactly one kind/ label Available
|
|
/kind misc |
|
This PR cannot be merged: expecting exactly one kind/ label Available
|
tekton-robot
added
size/M
In order to test Pipelines credentials in environments without root users (i.e. in openshift clusters, or other more locked-down envs) we need a container image that has a non-root user along with a tool to exercise the credentials. This commit adds an alpine-git-nonroot image to our plumbing repo for use in testing credentials in non-root environments. It uses alpine/git as its base and then adds a user called nonroot with UID 1000 to it. This image's first intended use is as a Step in an example TaskRun that will test creds-init credentials with non-root securityContext. That PR is ongoing here: tektoncd/pipeline#2671
ok, I've added a nightly cronjob for the image, along with an entry in |
|
@sbwsg yeah that is perfect I think 😉 We are going to document this better and most likely do a walkthrough/demo on the overall ci/cd on plumbing to help contributors 👼 🤞 |
|
/mario build tekton/images/alpine-git-nonroot alpine-git-nonroot:mario |
|
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: afrittoli The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
tekton-robot
added
the
approved
ghost
deleted the
Changes
In order to test Pipelines credentials in environments without
root users (i.e. in openshift clusters, or other more locked-down
envs) we need a container image that has a non-root user along
with a tool to exercise the credentials.
This commit adds an alpine-git-nonroot image to our plumbing repo
for use in testing credentials in non-root environments. It uses
alpine/git as its base and then adds a user called nonroot with
UID 1000 to it. This image's first intended use is as a Step in
an example TaskRun that will test creds-init credentials with
non-root securityContext. That PR is ongoing here:
tektoncd/pipeline#2671
Submitter Checklist