Skip to content

CFE-90: Excluded the rootless container store from chown of jenkins home #2421

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
nickanderson wants to merge 2 commits into
base: master
Choose a base branch
from
Open

CFE-90: Excluded the rootless container store from chown of jenkins home #2421

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5169c8e
Excluded the rootless container store from chown of jenkins home
nickanderson Aug 11, 2026
48beb18
Revert "Added subordinate id ranges for jenkins on CI container hosts"
nickanderson Aug 11, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 16 additions & 3 deletions ci/setup-cfengine-build-host.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,6 +14,19 @@ if [ "$(id -u)" != "0" ]; then
exit 1
fi

# chown(2) clears setuid bits even when the owner does not change, and the
# rootless container store lives under /home/jenkins, so a blanket chown -R
# strips /usr/bin/sudo inside stored images and breaks the next container build.
function chown-jenkins-home()
{
if [ -f /etc/cfengine-containers-host.flag ]; then
find /home/jenkins -path /home/jenkins/.local/share/containers -prune \
-o ! -user jenkins -exec chown jenkins {} +
else
chown -R jenkins /home/jenkins
fi
}

ls -la /home/
if ! id -u jenkins; then
useradd jenkins -p jenkins
Expand All @@ -27,8 +40,8 @@ fuser -k "$CHROOT_ROOT" >/dev/null 2>&1 || true
umount "${CHROOT_ROOT}proc" >/dev/null 2>&1 || true

# ENT-14386 often it seems we are experiencing a race condition with this script and something else causing trouble
if ! chown -R jenkins /home/jenkins; then
echo "ENT-14386 some trouble chown -R jenkins /home/jenkins, current processes are:"
if ! chown-jenkins-home; then
echo "ENT-14386 some trouble chowning /home/jenkins, current processes are:"
ps -efl
fi

Expand Down Expand Up @@ -78,7 +91,7 @@ function cleanup() {
ps -efl | grep cf
fi
ls -l /home
chown -R jenkins /home/jenkins
chown-jenkins-home
echo "Done with cleanup()"
}

Expand Down
33 changes: 0 additions & 33 deletions ci/setup-ci-host.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -25,28 +25,6 @@ function file-line()
fi
}

# Replaces an existing range for the user rather than appending a second one.
subids_changed=0
function subid-range()
{
local file=$1
local user=$2
local range=$3

touch "$file"
if grep -q "^$user:$range\$" "$file"; then
return
fi
if grep -q "^$user:" "$file"; then
echo "Correcting $user range in $file to $range"
sed -i "s|^$user:.*|$user:$range|" "$file"
else
echo "Adding $user:$range to $file"
echo "$user:$range" >> "$file"
fi
subids_changed=1
}

function github-known-hosts()
{
echo "ensuring github hostkeys are added to /home/jenkins/.ssh/known_hosts"
Expand Down Expand Up @@ -129,17 +107,6 @@ jenkins ALL=NOPASSWD: /usr/bin/podman
EOF
chmod 400 /etc/sudoers.d/999-local
chown root:root /etc/sudoers.d/999-local

# Without a subordinate id range, rootless container storage runs single-uid
# and drops setuid bits while extracting layers, breaking sudo in the image.
subid-range /etc/subuid jenkins 100000:65536
subid-range /etc/subgid jenkins 100000:65536
if [ "$subids_changed" = 1 ]; then
# Remap storage and discard images extracted under the previous mapping:
# migrate cannot restore setuid bits, so those images must be rebuilt.
su - jenkins -c 'podman system migrate'
su - jenkins -c 'buildah rmi --all --force'
fi
fi
exit 0
fi
Expand Down
Loading