Question

当我根据官方Jenkins Docker创建图像并将.ssh目录复制到jenkins用户的主页/var/jenkins_home）时，/var/jenkins_home/.ssh的所有者变为root这阻止我打开与jenkins用户的ssh会话。在RUN chown -R 1000:1000 /var/jenkins_home/.ssh中使用Dockerfile不起作用。

此外，创建图像时复制的文件的权限默认为644。但是，为了能够打开ssh会话，/var/jenkins_home/.ssh/id_rsa的权限必须为600。

如何从为jenkins用户提供ssh密钥的官方Jenkins Docker图像创建图像？

Answer 1

官方Jenkins Docker镜像将Jenkins主目录（/var/jenkins_home）定义为VOLUME，阻止RUN chown -R 1000:1000 /var/jenkins_home/...生效：

$ touch test.txt

$ vi Dockerfile
--- Dockerfile ---
FROM jenkins:2.32.3

COPY test.txt /tmp
COPY test.txt /var/jenkins_home/test.txt

USER root

RUN chown 1000:1000 /tmp/test.txt
RUN chown 1000:1000 /var/jenkins_home/test.txt

USER jenkins
--- Dockerfile ---

$ docker build -t myjenkins .
...

$ docker run -it myjenkins /bin/bash
jenkins@750f43b7e9ec:/$ ls -all /var/jenkins_home/test.txt
-rw-r--r-- 1 root root 0 Mar 24 06:54 /var/jenkins_home/test.txt
jenkins@750f43b7e9ec:/$ ls -all /tmp/test.txt
-rw-r--r-- 1 jenkins jenkins 0 Mar 24 06:54 /tmp/test.txt

官方詹金斯Docker有一个解决方案：复制目录和文件，这些目录和文件必须在jenkins用户的家中/usr/share/jenkins/ref/。当jenkins容器启动时，它会检查/var/jenkins_home是否有此参考内容，并在需要时将其复制到那里。（参见official Jenkins Docker documentation的Installing more tools）。

$ touch test.txt

$ vi Dockerfile
--- Dockerfile ---
FROM jenkins:2.32.3

COPY test.txt /usr/share/jenkins/ref/test.txt
--- Dockerfile ---

$ docker build -t myjenkins .
...

$ docker run -it myjenkins /bin/bash
jenkins@1e9520a92f8e:/$ ls -all /var/jenkins_home/test.txt
-rw-r--r-- 1 jenkins jenkins 0 Mar 24 08:21 /var/jenkins_home/test.txt

现在我们需要将文件的权限设置为600：

$ touch test.txt

$ vi Dockerfile
--- Dockerfile ---
FROM jenkins:2.32.3

COPY test.txt /usr/share/jenkins/ref/test.txt

USER root

RUN chmod 600 /usr/share/jenkins/ref/test.txt

USER jenkins
--- Dockerfile ---

$ docker build -t myjenkins .
...

$ docker run -it myjenkins /bin/bash
cp: cannot open ‘/usr/share/jenkins/ref/test.txt’ for reading: Permission denied

奇怪！ Jenkins的初始化脚本jenkins.sh抛出了错误。该脚本在Jenkins容器启动时运行。我们在这里可以做的是在容器启动时更改文件权限，而不是在Dockerfile中更改它。然后我们需要一个入口点脚本，将文件复制到/var/jenkins_home，更改它的权限，最后一步调用jenkins.sh。我根据https://github.com/openfrontier/docker-jenkins/blob/master/entrypoint.sh创建了entrypoint.sh。

$ touch test.txt

$ vi entrypoint.sh
--- enrypoint.sh ---
#! /bin/bash -e

cp /usr/share/jenkins/ref/test.txt /var/jenkins_home
chmod 600 /var/jenkins_home/test.txt

echo "start JENKINS"
# if 'docker run' first argument start with '--' the user is passing jenkins launcher arguments
if [[ $# -lt 1 ]] || [[ "$1" == "--"* ]]; then
    exec /bin/tini -- /usr/local/bin/jenkins.sh "$@"
fi
exec "$@"
--- enrypoint.sh ---

$ vi Dockerfile
--- Dockerfile ---
FROM jenkins:2.32.3

COPY test.txt /usr/share/jenkins/ref/test.txt
COPY entrypoint.sh /entrypoint.sh

USER root

RUN chown 1000:1000 /entrypoint.sh \
  && chmod +x /entrypoint.sh

USER jenkins

ENTRYPOINT ["/entrypoint.sh"]
--- Dockerfile ---


$ docker build -t myjenkins .
...

$ docker run -it myjenkins /bin/bash
start JENKINS
jenkins@770ba9099cb4:/$ ls -all /var/jenkins_home/test.txt
-rw------- 1 jenkins jenkins 0 Mar 24 10:36 /var/jenkins_home/test.txt

让我们为ssh目录创建id_rsa和id_rsa.pub个文件。请注意，作为目录名称，我使用了ssh而不是.ssh。否则，.ssh的内容将直接复制到/var/jenkins_home。这就是Docker对名称以点开头的目录（例如.m2）的行为。

以下是所有必要步骤。您可以看到我可以从容器中成功打开ssh会话：

$ ls -all
total 8
drwxr-xr-x 3 myuser mygroup  54 Mar 24 13:41 .
drwxr-xr-x 6 myuser mygroup  70 Mar 24 09:54 ..
-rw-r--r-- 1 myuser mygroup 242 Mar 24 13:35 Dockerfile
-rw-r--r-- 1 myuser mygroup 338 Mar 24 13:33 entrypoint.sh
drwx------ 2 myuser mygroup  36 Mar 24 11:24 ssh

$ ls -all ssh/
total 8
drwx------ 2 myuser mygroup   36 Mar 24 11:24 .
drwxr-xr-x 3 myuser mygroup   54 Mar 24 13:41 ..
-rw------- 1 myuser mygroup 1679 Mar 24 11:23 id_rsa
-rw-r--r-- 1 myuser mygroup  391 Mar 24 11:23 id_rsa.pub

$ vi entrypoint.sh
--- enrypoint.sh ---
#! /bin/bash -e

mkdir -p /var/jenkins_home/.ssh
mv /usr/share/jenkins/ref/.ssh/id_rsa /var/jenkins_home/.ssh
chmod 600 /var/jenkins_home/.ssh/id_rsa

echo "start JENKINS"
# if 'docker run' first argument start with '--' the user is passing jenkins launcher arguments
if [[ $# -lt 1 ]] || [[ "$1" == "--"* ]]; then
    exec /bin/tini -- /usr/local/bin/jenkins.sh "$@"
fi
exec "$@"
--- enrypoint.sh ---

$ vi Dockerfile
--- Dockerfile ---
FROM jenkins:2.32.3

# Copy ssh as .ssh
COPY ssh/ /usr/share/jenkins/ref/.ssh
COPY entrypoint.sh /entrypoint.sh

USER root

# Change owner of .ssh directory and files under it to
# jenkins user's owner (1000:1000) and make sure
# permisson of id_rsa is not 600.
RUN chown -R 1000:1000 /usr/share/jenkins/ref/.ssh \
    && chmod 644 /usr/share/jenkins/ref/.ssh/id_rsa

RUN chown 1000:1000 /entrypoint.sh \
    && chmod +x /entrypoint.sh

USER jenkins

ENTRYPOINT ["/entrypoint.sh"]
--- Dockerfile ---


$ docker build -t myjenkins .
...

$ docker run -it myjenkins /bin/bash
jenkins@3090dda362d6:/$ ls -all /var/jenkins_home/.ssh/id_rsa
-rw------- 1 jenkins jenkins 1679 Mar 24 08:23 /var/jenkins_home/.ssh/id_rsa

jenkins@3090dda362d6:/$ ssh rose1
The authenticity of host 'rose1 (XX.XX.XX.XX)' can't be established.
ECDSA key fingerprint is XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX:XX.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added 'rose1,XX.XX.XX.XX' (ECDSA) to the list of known hosts.
Last login: Thu Mar 23 15:55:41 2017 from 10.74.200.56
[jenkins@rose1 ~]$

更新1

我已将指定文件上传到GitHub：https://github.com/kumlali/stackoverflow_answers/tree/master/docker_jenkins_ssh_keys/answer1

Answer 2

我发现有点复杂但更通用的方法来实现这一点。新解决方案需要;

ssh-agent，credentials和ssh-credentials插件
创建Docker镜像时安装插件（Installing more tools - Preinstalling plugins）
通过执行post-initialization script。

这里的主要思想是将ssh密钥复制到JENKINS_HOME以外的目录中，并将它们添加到Jenkins＆＃39;使用后初始化脚本并使用ssh-agent插件进行ssh。

的凭据

我已将必要的设置和说明上传到GitHub：https://github.com/kumlali/stackoverflow_answers/tree/master/docker_jenkins_ssh_keys/answer2

如何为jenkins用户创建使用提供的ssh密钥的Jenkins Docker镜像？

2 个答案: