Mailing-List: contact user-help@bigtop.apache.org; run by ezmlm
Precedence: bulk
Reply-To: user@bigtop.apache.org
Date: Fri, 25 Dec 2015 20:48:20 -0800
From: Konstantin Boudnik <cos@apache.org>
To: dev@bigtop.apache.org, user@bigtop.apache.org
Subject: Re: CI improvements [Was: The state of new CI]
Message-ID: <20151226044820.GB4288@tpx>
Mail-Followup-To: dev@bigtop.apache.org, user@bigtop.apache.org
References: <20151223203434.GC10680@tpx>
 <CA+ULb+uT3zTORk=G2bvVg2ivQhr2hXL0uVkzXVbo+eR78-kw-A@mail.gmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
	protocol="application/pgp-signature"; boundary="Fba/0zbH8Xs+Fj9o"
Content-Disposition: inline
In-Reply-To: 
 <CA+ULb+uT3zTORk=G2bvVg2ivQhr2hXL0uVkzXVbo+eR78-kw-A@mail.gmail.com>
User-Agent: Mutt/1.5.21 (2010-09-15)


--Fba/0zbH8Xs+Fj9o
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Dec 23, 2015 at 01:13PM, Roman Shaposhnik wrote:
> On Wed, Dec 23, 2015 at 12:34 PM, Konstantin Boudnik <cos@apache.org> wro=
te:
> > Guys,
> >
> > I've been trying to replicate our CI elsewhere and here's a couple of
> > observations and proposed fixes that might do such things easier in the
> > future.
> >
> > 1. Running build as root inside of the docker container.
> >
> >    This seems like a real issue, especially considering that we have al=
ways
> >    advocated to stay away from such practice. Unfortunately, adding
> >     -u jenkins:jenkins
> >    to docker run snags on a couple of points
>=20
> Can you elaborate on this?

After 2 days I suddenly understood what you were asking me about ;) There's
not a single JIRA in my original email that is clearly connected to the sna=
gs.

The main issue is that running a build inside of a container (as non-root
user) is in jeopardy of folder permissions, used as a volume in the the
container. One way around it, as we have discussed off-line last night, is =
to
create effective user insides of the container dynamically. This is hack, of
course, but in reality the whole docker is a chroot hack, so how much worst
it could be, right?

These's some potential security implications in the approach like this, but
considering that we are running a pretty tight ship, controlling the
CI environment, we should be fine.

Cos

--Fba/0zbH8Xs+Fj9o
Content-Type: application/pgp-signature; name="signature.asc"
Content-Description: Digital signature

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)

iF4EAREIAAYFAlZ+HBQACgkQenyFlstYjhKAJgD+MMobElMKTWZwMYILWwgc01fv
akBGcIHeZB66Oap885EBANQO/0gCvaSqT8LPtrz1QU+annJhQBXYPa6lXZVuQzB0
=CwcO
-----END PGP SIGNATURE-----

--Fba/0zbH8Xs+Fj9o--