public_git/kaniko
1
0
Fork 0
mirror of https://github.com/GoogleContainerTools/kaniko synced 2026-10-22 10:38:44 +02:00
Code Issues Releases Wiki Activity

Merged master, fixed merge conflict

Browse Source
This commit is contained in:
Priya Wadhwa
2018-05-10 13:51:23 -07:00
parent 6972bdbb16 b9fb466300
commit 33f4805f62
7 changed files with 106 additions and 12 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+57 -3
View File
@@ -146,13 +146,67 @@ To run kaniko in Docker, run the following command:
kaniko uses Docker credential helpers to push images to a registry.
kaniko comes with support for GCR, but configuring another credential helper should allow pushing to a different registry.
kaniko comes with support for GCR and Amazon ECR, but configuring another credential helper should allow pushing to a different registry.
#### Pushing to Amazon ECR
The Amazon ECR [credential helper](https://github.com/awslabs/amazon-ecr-credential-helper) is built in to the kaniko executor image.
To configure credentials, you will need to do the following:
1. Update the `credHelpers` section of [config.json](https://github.com/GoogleContainerTools/kaniko/blob/master/files/config.json) with the specific URI of your ECR registry:
```json
{
"credHelpers": {
"aws_account_id.dkr.ecr.region.amazonaws.com": "ecr-login"
}
}
```
You can mount in the new config as a configMap:
```shell
kubectl create configmap docker-config --from-file=<path to config.json>
```
2. Create a Kubernetes secret for your `~/.aws/credentials` file so that credentials can be accessed within the cluster.
To create the secret, run:
```shell
kubectl create secret generic aws-secret --from-file=<path to .aws/credentials>
```
The Kubernetes Pod spec should look similar to this, with the args parameters filled in:
```yaml
apiVersion: v1
kind: Pod
metadata:
name: kaniko
spec:
containers:
- name: kaniko
image: gcr.io/kaniko-project/executor:latest
args: ["--dockerfile=<path to Dockerfile>",
"--context=<path to build context>",
"--destination=<aws_account_id.dkr.ecr.region.amazonaws.com/my-repository:my-tag>"]
volumeMounts:
- name: aws-secret
mountPath: /root/.aws/
- name: docker-config
mountPath: /root/.docker/
restartPolicy: Never
volumes:
- name: aws-secret
secret:
secretName: aws-secret
- name: docker-config
configMap:
name: docker-config
```
### Debug Image
We provide `gcr.io/kaniko-project/executor:debug` as a a version of the executor image based off a Debian image.
This provides a shell and can be useful for debugging.
The kaniko executor image is based off of scratch and doesn't contain a shell.
We provide `gcr.io/kaniko-project/executor:debug`, a debug image which consists of the kaniko executor image along with a busybox shell to enter.
You can launch the debug image with a shell entrypoint:
```shell
docker run -it --entrypoint=/busybox/sh gcr.io/kaniko-project/executor:debug
```
## Security
kaniko by itself **does not** make it safe to run untrusted builds inside your cluster, or anywhere else.
deploy/Dockerfile
+7 -3
View File
@@ -18,13 +18,17 @@ FROM golang:1.10
WORKDIR /go/src/github.com/GoogleContainerTools/kaniko
COPY . .
RUN make
WORKDIR /usr/local/bin
ADD https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v1.4.3-static/docker-credential-gcr_linux_amd64-1.4.3.tar.gz .
RUN tar -xvzf /usr/local/bin/docker-credential-gcr_linux_amd64-1.4.3.tar.gz
# Get GCR credential helper
ADD https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v1.4.3-static/docker-credential-gcr_linux_amd64-1.4.3.tar.gz /usr/local/bin/
RUN tar -C /usr/local/bin/ -xvzf /usr/local/bin/docker-credential-gcr_linux_amd64-1.4.3.tar.gz
# Get Amazon ECR credential helper
RUN go get -u github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login
RUN make -C /go/src/github.com/awslabs/amazon-ecr-credential-helper linux-amd64
FROM scratch
COPY --from=0 /go/src/github.com/GoogleContainerTools/kaniko/out/executor /kaniko/executor
COPY --from=0 /usr/local/bin/docker-credential-gcr /usr/local/bin/docker-credential-gcr
COPY --from=0 /go/src/github.com/awslabs/amazon-ecr-credential-helper/bin/linux-amd64/docker-credential-ecr-login /usr/local/bin/docker-credential-ecr-login
COPY files/ca-certificates.crt /kaniko/ssl/certs/
COPY files/config.json /root/.docker/
RUN ["docker-credential-gcr", "config", "--token-source=env"]
deploy/Dockerfile_debug
+27 -4
View File
@@ -12,14 +12,37 @@
# See the License for the specific language governing permissions and
# limitations under the License.
# Builds the executor from debian
# Builds the static Go image to execute in a Kubernetes job
FROM gcr.io/google-appengine/debian9:latest
COPY out/executor /kaniko/executor
# Stage 0: Build the executor binary and get credential helpers
FROM golang:1.10
WORKDIR /go/src/github.com/GoogleContainerTools/kaniko
COPY . .
RUN make
# Get GCR credential helper
ADD https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/download/v1.4.3-static/docker-credential-gcr_linux_amd64-1.4.3.tar.gz /usr/local/bin/
RUN tar -C /usr/local/bin/ -xvzf /usr/local/bin/docker-credential-gcr_linux_amd64-1.4.3.tar.gz
# Get Amazon ECR credential helper
RUN go get -u github.com/awslabs/amazon-ecr-credential-helper/ecr-login/cli/docker-credential-ecr-login
RUN make -C /go/src/github.com/awslabs/amazon-ecr-credential-helper linux-amd64
# Stage 1: Get the busybox shell
FROM gcr.io/cloud-builders/bazel:latest
RUN git clone https://github.com/GoogleContainerTools/distroless.git
WORKDIR /distroless
RUN bazel build busybox:busybox.tar
RUN tar -C /distroless/bazel-genfiles/busybox/ -xf /distroless/bazel-genfiles/busybox/busybox.tar
FROM scratch
COPY --from=0 /go/src/github.com/GoogleContainerTools/kaniko/out/executor /kaniko/executor
COPY --from=0 /usr/local/bin/docker-credential-gcr /usr/local/bin/docker-credential-gcr
COPY --from=0 /go/src/github.com/awslabs/amazon-ecr-credential-helper/bin/linux-amd64/docker-credential-ecr-login /usr/local/bin/docker-credential-ecr-login
COPY --from=1 /distroless/bazel-genfiles/busybox/busybox/ /busybox/
COPY files/ca-certificates.crt /kaniko/ssl/certs/
COPY files/docker-credential-gcr /usr/local/bin/
COPY files/config.json /root/.docker/
RUN ["docker-credential-gcr", "config", "--token-source=env"]
ENV HOME /root
ENV USER /root
ENV PATH /usr/local/bin
ENV SSL_CERT_DIR=/kaniko/ssl/certs
ENTRYPOINT ["/kaniko/executor"]
deploy/executor-release.yaml
+6 -1
View File
@@ -3,4 +3,9 @@ steps:
- name: "gcr.io/cloud-builders/docker"
args: ["build", "-f", "deploy/Dockerfile",
"-t", "gcr.io/kaniko-project/executor:${COMMIT_SHA}", "."]
images: ["gcr.io/kaniko-project/executor:${COMMIT_SHA}"]
# Then, we want to build kaniko:debug
- name: "gcr.io/cloud-builders/docker"
args: ["build", "-f", "deploy/Dockerfile_debug",
"-t", "gcr.io/kaniko-project/executor:debug-${COMMIT_SHA}", "."]
images: ["gcr.io/kaniko-project/executor:${COMMIT_SHA}",
"gcr.io/kaniko-project/executor:debug-${COMMIT_SHA}"]
integration_tests/dockerfiles/Dockerfile_test_copy
+1 -1
View File
@@ -1,4 +1,4 @@
FROM gcr.io/distroless/base
FROM alpine:3.7
COPY context/foo foo
COPY context/foo /foodir/
COPY context/bar/b* bar/
pkg/commands/commands.go
+2
View File
@@ -66,6 +66,8 @@ func GetCommand(cmd instructions.Command, buildcontext string) (DockerCommand, e
return &StopSignalCommand{cmd: c}, nil
case *instructions.ArgCommand:
return &ArgCommand{cmd: c}, nil
case *instructions.ShellCommand:
return &ShellCommand{cmd: c}, nil
case *instructions.MaintainerCommand:
logrus.Warnf("%s is deprecated, skipping", cmd.Name())
return nil, nil
pkg/util/fs_util.go
+6
View File
@@ -94,6 +94,12 @@ func GetFSFromImage(img v1.Image) error {
logrus.Infof("Not adding %s because it is whitelisted", path)
continue
}
if hdr.Typeflag == tar.TypeSymlink {
if checkWhitelist(hdr.Linkname, whitelist) {
logrus.Debugf("skipping symlink from %s to %s because %s is whitelisted", hdr.Linkname, path, hdr.Linkname)
continue
}
}
fs[path] = struct{}{}
if err := extractFile("/", hdr, tr); err != nil {