public_git
/
kaniko
mirror of https://github.com/GoogleContainerTools/kaniko
1
0
Fork 0
Code Issues Releases Wiki Activity

Merge branch 'master', add examples

This commit is contained in:
Priya Wadhwa 2018-04-02 14:29:25 -07:00
parent fad0d25aec 99e030c71f
commit bf662d986b
No known key found for this signature in database
GPG Key ID: 0D0DAFD8F7AA73AE
18 changed files with 573 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
Makefile
View File

@ -35,7 +35,7 @@ EXECUTOR_PACKAGE = $(REPOPATH)/executor
KANIKO_PROJECT = $(REPOPATH)/kaniko
out/executor: $(GO_FILES)
GOOS=$* GOARCH=$(GOARCH) CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(EXECUTOR_PACKAGE)
GOARCH=$(GOARCH) GOOS=linux CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(EXECUTOR_PACKAGE)
out/kaniko: $(GO_FILES)
@ -52,3 +52,11 @@ integration-test: out/executor out/kaniko
.PHONY: images
images: out/executor out/kaniko
docker build -t $(REGISTRY)/executor:latest -f deploy/Dockerfile .
.PHONY: run-in-docker
run-in-docker: images
docker run \
-v $(HOME)/.config/gcloud:/root/.config/gcloud \
-v $(GOOGLE_APPLICATION_CREDENTIALS):$(GOOGLE_APPLICATION_CREDENTIALS) \
-e GOOGLE_APPLICATION_CREDENTIALS=$(GOOGLE_APPLICATION_CREDENTIALS) \
$(REGISTRY)/executor:latest

76
README.md
View File

@ -1,36 +1,100 @@
# kaniko
kaniko is a tool to build container images from a Dockerfile without a Docker daemon. This enables building container images in unpriviliged environments, which can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster.
kaniko is a tool to build unpriviliged container images from a Dockerfile. It doesn't depend on a Docker daemon, which enables building container images in environments that can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster.
The majority of Dockerfile commands can be executed with kaniko, but we're still working on supporting the following commands:
* ADD
* VOLUME
* SHELL
* HEALTHCHECK
* STOPSIGNAL
* ONBUILD
* ARG
* VOLUME
We're currently in the process of building kaniko, so as of now it isn't production ready. Please let us know if you have any feature requests or find any bugs!
## How does it work?
The kaniko executor image is responsible for building the final image from a Dockerfile and pushing it to a registry. Within the executor image, we extract the filesystem of the base image (the FROM image in the Dockerfile). We then execute the commands in the Dockerfile, snapshotting the filesystem in userspace after each one. After each command, we append a layer of changed files to the base image (if there are any) and update image metadata.
## kaniko Build Context
kaniko supports local directories and GCS buckets as build contexts. To specify a local directory, pass in the `--context=<path to build context>` flag as an argument to the executor image. To specify a GCS bucket, pass in the `--bucket=<GCS bucket name>` flag. The GCS bucket should contain a compressed tar of the build context called `context.tar.gz`, which kaniko will unpack and use as the build context.
To easily create `context.tar.gz`, we can use [skaffold](https://github.com/GoogleCloudPlatform/skaffold).
Running `skaffold docker context` will create `context.tar.gz`, which will contain the Dockerfile and any files it depends on.
We can copy over the compressed tar with gsutil:
`gsutil cp context.tar.gz gs://<bucket name>`
## Running kaniko locally
Requirements:
* Docker
* gcloud
We can run the kaniko executor image locally in a Docker daemon to build and push an image from a Dockerfile.
First, to build the executor image locally, run `make images`. This will load the executor image into your Docker daemon.
To run kaniko in Docker, run the following command:
`./run_in_docker.sh <path to build context> <destination of final image in the form gcr.io/$PROJECT/$IMAGE:$TAG>`
## Running kaniko in a Kubernetes cluster
kaniko runs as an image, which is responsible for building the final image from a Dockerfile and pushing it to a GCR registry.
Requirements:
* Standard Kubernetes cluster
* Kubernetes Secret
To run kaniko in a Kubernetes cluster, you will need a standard running Kubernetes cluster and a Kubernetes secret, which contains the auth required to push the final image.
`make images`
To create the secret, first you will need to create a service account in the Pantheon project you want to push the final image to, with `Storage Admin` permissions. You can download a JSON key for this service account, and rename it `kaniko-secret.json`. To create the secret, run:
The image takes in three arguments: a path to a Dockerfile, a path to a build context, and the GCR registry the final image should be pushed to (in the form gcr.io/$PROJECT/$IMAGE:$TAG)
`kubectl create secret generic kaniko-secret --from-file=<path to kaniko-secret.json>`
The Kubernetes job.yaml should look similar to this, with the args parameters filled in:
## Comparison with Other Tools
```yaml
apiVersion: batch/v1
kind: Job
metadata:
name: kaniko
spec:
template:
spec:
containers:
- name: kaniko
image: gcr.io/kaniko-project/executor:latest
args: ["--dockerfile=<path to Dockerfile>", "--bucket=<GCS bucket where context.tar.gz lives>", "--destination=<gcr.io/$PROJECT/$IMAGE:$TAG>"]
volumeMounts:
- name: kaniko-secret
mountPath: /secret
env:
- name: GOOGLE_APPLICATION_CREDENTIALS
value: /secret/kaniko-secret.json
restartPolicy: Never
volumes:
- name: kaniko-secret
secret:
secretName: kaniko-secret
```
This example pulls the build context from a GCS bucket. To use a local directory build context, you could consider using configMaps to mount in small build context.
## Comparison with Other Tools/Solutions
Similar tools include:
* [img](https://github.com/genuinetools/img)
* [orca-build](https://github.com/cyphar/orca-build)
* [buildah](https://github.com/projectatomic/buildah)
* [Bazel](https://github.com/bazelbuild/rules_docker)/[FTL](https://github.com/GoogleCloudPlatform/runtimes-common/tree/master/ftl)
All of these tools build container images; however, the way in which they accomplish this differs from kaniko. Both kaniko and img build unprivileged images, but they interpret “unprivileged” differently. img builds as a non root user from within the container, while kaniko is run in an unprivileged environment with root access inside the container.
Unlike orca-build, kaniko doesn't use runC to build images. Instead, it runs as a root user within the container.
buildah requires the same root privilges as a Docker daemon does to run, while kaniko runs without any special privileges or permissions.
Bazel/FTL aim to improve DevEx by achieving the fastest possible creation of Docker images, at the expense of build compatibility. By restricting the set of allowed builds to an optimizable subset, we get the nice side effect of being able to run without privileges inside an arbitrary cluster.
These approaches can be thought of as special-case "fast paths" that can be used in conjunction with the support for general Dockerfile kaniko provides.

1
deploy/Dockerfile
View File

@ -19,5 +19,6 @@ ADD out/executor /kaniko/executor
ADD files/ca-certificates.crt /etc/ssl/certs/
ADD files/docker-credential-gcr /usr/local/bin/
ADD files/config.json /root/.docker/
RUN ["docker-credential-gcr", "config", "--token-source=env"]
ENV HOME /root
ENV PATH /usr/local/bin

22
examples/kubernetes/job.yaml Normal file
View File

@ -0,0 +1,22 @@
apiVersion: batch/v1
kind: Job
metadata:
name: kbuild-demo
spec:
template:
spec:
containers:
- name: init-static
image: gcr.io/priya-wadhwa/executor:latest
command: ["/work-dir/executor", "--context=kbuild-demo", "--name=gcr.io/priya-wadhwa/kbuild:example", "--dockerfile=/workspace/Dockerfile"]
volumeMounts:
- name: dockerfile-volume
mountPath: /workspace/
restartPolicy: Never
volumes:
- name: dockerfile-volume
configMap:
name: dockerfile-config
items:
- key: Dockerfile
path: Dockerfile

19
integration_tests/dockerfiles/Dockerfile_test_user_run Normal file
View File

@ -0,0 +1,19 @@
# Copyright 2018 Google, Inc. All rights reserved.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
FROM gcr.io/google-appengine/debian9
RUN useradd testuser
RUN groupadd testgroup
USER testuser:testgroup
RUN echo "hey" > /tmp/foo

13
integration_tests/dockerfiles/Dockerfile_test_workdir Normal file
View File

@ -0,0 +1,13 @@
FROM gcr.io/google-appengine/debian9:latest
COPY context/foo foo
WORKDIR /test
# Test that this will be appended on to the previous command, to create /test/workdir
WORKDIR workdir
COPY context/foo ./currentfoo
# Test that the RUN command will happen in the correct directory
RUN cp currentfoo newfoo
WORKDIR /new/dir
ENV dir /another/new/dir
WORKDIR $dir/newdir
WORKDIR $dir/$doesntexist
WORKDIR /

12
integration_tests/dockerfiles/config_test_workdir.json Normal file
View File

@ -0,0 +1,12 @@
[
{
"Image1": "gcr.io/kaniko-test/docker-test-workdir:latest",
"Image2": "gcr.io/kaniko-test/kaniko-test-workdir:latest",
"DiffType": "File",
"Diff": {
"Adds": null,
"Dels": null,
"Mods": null
}
}
]

15
integration_tests/dockerfiles/test_user.yaml Normal file
View File

@ -0,0 +1,15 @@
schemaVersion: '2.0.0'
commandTests:
- name: 'whoami'
command: 'whoami'
expectedOutput: ['testuser']
excludedOutput: ['root']
- name: 'file owner'
command: 'ls'
args: ['-l', '/tmp/foo']
expectedOutput: ['.*testuser.*', '.*testgroup.*']
excludedOutput: ['.*root.*']
fileContentTests:
- name: "/tmp/foo"
path: "/tmp/foo"
expectedContent: ["hey"]

14
integration_tests/integration_test_yaml.go
View File

@ -57,6 +57,13 @@ var fileTests = []struct {
context: "/workspace/integration_tests/",
repo: "test-copy",
},
{
description: "test workdir",
dockerfilePath: "/workspace/integration_tests/dockerfiles/Dockerfile_test_workdir",
configPath: "/workspace/integration_tests/dockerfiles/config_test_workdir.json",
context: "/workspace/integration_tests/",
repo: "test-workdir",
},
}
var structureTests = []struct {
@ -80,6 +87,13 @@ var structureTests = []struct {
dockerBuildContext: "/workspace/integration_tests/dockerfiles/",
structureTestYamlPath: "/workspace/integration_tests/dockerfiles/test_metadata.yaml",
},
{
description: "test user command",
dockerfilePath: "/workspace/integration_tests/dockerfiles/Dockerfile_test_user_run",
repo: "test-user",
dockerBuildContext: "/workspace/integration_tests/dockerfiles/",
structureTestYamlPath: "/workspace/integration_tests/dockerfiles/test_user.yaml",
},
}
type step struct {

4
pkg/commands/commands.go
View File

@ -44,12 +44,16 @@ func GetCommand(cmd instructions.Command, buildcontext string) (DockerCommand, e
return &ExposeCommand{cmd: c}, nil
case *instructions.EnvCommand:
return &EnvCommand{cmd: c}, nil
case *instructions.WorkdirCommand:
return &WorkdirCommand{cmd: c}, nil
case *instructions.CmdCommand:
return &CmdCommand{cmd: c}, nil
case *instructions.EntrypointCommand:
return &EntrypointCommand{cmd: c}, nil
case *instructions.LabelCommand:
return &LabelCommand{cmd: c}, nil
case *instructions.UserCommand:
return &UserCommand{cmd: c}, nil
}
return nil, errors.Errorf("%s is not a supported command", cmd.Name())
}

1
pkg/commands/expose.go
View File

@ -30,6 +30,7 @@ type ExposeCommand struct {
}
func (r *ExposeCommand) ExecuteCommand(config *manifest.Schema2Config) error {
logrus.Info("cmd: EXPOSE")
// Grab the currently exposed ports
existingPorts := config.ExposedPorts
// Add any new ones in

1
pkg/commands/label.go
View File

@ -29,6 +29,7 @@ type LabelCommand struct {
}
func (r *LabelCommand) ExecuteCommand(config *manifest.Schema2Config) error {
logrus.Info("cmd: LABEL")
return updateLabels(r.cmd.Labels, config)
}

23
pkg/commands/run.go
View File

@ -22,7 +22,9 @@ import (
"github.com/sirupsen/logrus"
"os"
"os/exec"
"strconv"
"strings"
"syscall"
)
type RunCommand struct {
@ -44,7 +46,28 @@ func (r *RunCommand) ExecuteCommand(config *manifest.Schema2Config) error {
logrus.Infof("args: %s", newCommand[1:])
cmd := exec.Command(newCommand[0], newCommand[1:]...)
cmd.Dir = config.WorkingDir
cmd.Stdout = os.Stdout
// If specified, run the command as a specific user
if config.User != "" {
userAndGroup := strings.Split(config.User, ":")
// uid and gid need to be uint32
uid64, err := strconv.ParseUint(userAndGroup[0], 10, 32)
if err != nil {
return err
}
uid := uint32(uid64)
var gid uint32
if len(userAndGroup) > 1 {
gid64, err := strconv.ParseUint(userAndGroup[1], 10, 32)
if err != nil {
return err
}
gid = uint32(gid64)
}
cmd.SysProcAttr = &syscall.SysProcAttr{}
cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid}
}
return cmd.Run()
}

95
pkg/commands/user.go Normal file
View File

@ -0,0 +1,95 @@
/*
Copyright 2018 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package commands
import (
"github.com/GoogleCloudPlatform/k8s-container-builder/pkg/util"
"github.com/containers/image/manifest"
"github.com/docker/docker/builder/dockerfile/instructions"
"github.com/sirupsen/logrus"
"os/user"
"strings"
)
type UserCommand struct {
cmd *instructions.UserCommand
}
func (r *UserCommand) ExecuteCommand(config *manifest.Schema2Config) error {
logrus.Info("cmd: USER")
u := r.cmd.User
userAndGroup := strings.Split(u, ":")
userStr, err := util.ResolveEnvironmentReplacement(userAndGroup[0], config.Env, false)
if err != nil {
return err
}
var groupStr string
if len(userAndGroup) > 1 {
groupStr, err = util.ResolveEnvironmentReplacement(userAndGroup[1], config.Env, false)
if err != nil {
return err
}
}
// Lookup by username
userObj, err := user.Lookup(userStr)
if err != nil {
if _, ok := err.(user.UnknownUserError); ok {
// Lookup by id
userObj, err = user.LookupId(userStr)
if err != nil {
return err
}
} else {
return err
}
}
// Same dance with groups
var group *user.Group
if groupStr != "" {
group, err = user.LookupGroup(groupStr)
if err != nil {
if _, ok := err.(user.UnknownGroupError); ok {
group, err = user.LookupGroupId(groupStr)
if err != nil {
return err
}
} else {
return err
}
}
}
uid := userObj.Uid
if group != nil {
uid = uid + ":" + group.Gid
}
logrus.Infof("Setting user to %s", uid)
config.User = uid
return nil
}
func (r *UserCommand) FilesToSnapshot() []string {
return []string{}
}
func (r *UserCommand) CreatedBy() string {
s := []string{r.cmd.Name(), r.cmd.User}
return strings.Join(s, " ")
}

98
pkg/commands/user_test.go Normal file
View File

@ -0,0 +1,98 @@
/*
Copyright 2018 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package commands
import (
"github.com/GoogleCloudPlatform/k8s-container-builder/testutil"
"github.com/containers/image/manifest"
"github.com/docker/docker/builder/dockerfile/instructions"
"testing"
)
var userTests = []struct {
user string
expectedUid string
shouldError bool
}{
{
user: "root",
expectedUid: "0",
shouldError: false,
},
{
user: "0",
expectedUid: "0",
shouldError: false,
},
{
user: "fakeUser",
expectedUid: "",
shouldError: true,
},
{
user: "root:root",
expectedUid: "0:0",
shouldError: false,
},
{
user: "0:root",
expectedUid: "0:0",
shouldError: false,
},
{
user: "root:0",
expectedUid: "0:0",
shouldError: false,
},
{
user: "0:0",
expectedUid: "0:0",
shouldError: false,
},
{
user: "root:fakeGroup",
expectedUid: "",
shouldError: true,
},
{
user: "$envuser",
expectedUid: "0",
shouldError: false,
},
{
user: "root:$envgroup",
expectedUid: "0:0",
shouldError: false,
},
}
func TestUpdateUser(t *testing.T) {
for _, test := range userTests {
cfg := &manifest.Schema2Config{
Env: []string{
"envuser=root",
"envgroup=root",
},
}
cmd := UserCommand{
&instructions.UserCommand{
User: test.user,
},
}
err := cmd.ExecuteCommand(cfg)
testutil.CheckErrorAndDeepEqual(t, test.shouldError, err, test.expectedUid, cfg.User)
}
}

58
pkg/commands/workdir.go Normal file
View File

@ -0,0 +1,58 @@
/*
Copyright 2018 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package commands
import (
"github.com/GoogleCloudPlatform/k8s-container-builder/pkg/util"
"github.com/containers/image/manifest"
"github.com/docker/docker/builder/dockerfile/instructions"
"github.com/sirupsen/logrus"
"os"
"path/filepath"
)
type WorkdirCommand struct {
cmd *instructions.WorkdirCommand
snapshotFiles []string
}
func (w *WorkdirCommand) ExecuteCommand(config *manifest.Schema2Config) error {
logrus.Info("cmd: workdir")
workdirPath := w.cmd.Path
resolvedWorkingDir, err := util.ResolveEnvironmentReplacement(workdirPath, config.Env, true)
if err != nil {
return err
}
if filepath.IsAbs(resolvedWorkingDir) {
config.WorkingDir = resolvedWorkingDir
} else {
config.WorkingDir = filepath.Join(config.WorkingDir, resolvedWorkingDir)
}
logrus.Infof("Changed working directory to %s", config.WorkingDir)
w.snapshotFiles = []string{config.WorkingDir}
return os.MkdirAll(config.WorkingDir, 0755)
}
// FilesToSnapshot returns the workingdir, which should have been created if it didn't already exist
func (w *WorkdirCommand) FilesToSnapshot() []string {
return w.snapshotFiles
}
// CreatedBy returns some information about the command for the image config history
func (w *WorkdirCommand) CreatedBy() string {
return w.cmd.Name() + " " + w.cmd.Path
}

83
pkg/commands/workdir_test.go Normal file
View File

@ -0,0 +1,83 @@
/*
Copyright 2018 Google LLC
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
*/
package commands
import (
"github.com/GoogleCloudPlatform/k8s-container-builder/testutil"
"github.com/containers/image/manifest"
"github.com/docker/docker/builder/dockerfile/instructions"
"testing"
)
// Each test here changes the same WorkingDir field in the config
// So, some of the tests build off of each other
// This is needed to make sure WorkingDir handles paths correctly
// For example, if WORKDIR specifies a non-absolute path, it should be appended to the current WORKDIR
var workdirTests = []struct {
path string
expectedPath string
}{
{
path: "/a",
expectedPath: "/a",
},
{
path: "b",
expectedPath: "/a/b",
},
{
path: "c",
expectedPath: "/a/b/c",
},
{
path: "/d",
expectedPath: "/d",
},
{
path: "$path",
expectedPath: "/d/usr",
},
{
path: "$home",
expectedPath: "/root",
},
{
path: "$path/$home",
expectedPath: "/root/usr/root",
},
}
func TestWorkdirCommand(t *testing.T) {
cfg := &manifest.Schema2Config{
WorkingDir: "/",
Env: []string{
"path=usr/",
"home=/root",
},
}
for _, test := range workdirTests {
cmd := WorkdirCommand{
cmd: &instructions.WorkdirCommand{
Path: test.path,
},
snapshotFiles: []string{},
}
cmd.ExecuteCommand(cfg)
testutil.CheckErrorAndDeepEqual(t, false, nil, test.expectedPath, cfg.WorkingDir)
}
}

35
run_in_docker.sh Executable file
View File

@ -0,0 +1,35 @@
# Copyright 2018 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
# http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#!/bin/bash
set -e
if [ $# -ne 3 ];
then echo "Usage: run_in_docker.sh <path to Dockerfile> <context directory> <image tag>"
fi
dockerfile=$1
context=$2
tag=$3
if [[ ! -e $HOME/.config/gcloud/application_default_credentials.json ]]; then
echo "Application Default Credentials do not exist. Run [gcloud auth application-default login] to configure them"
exit 1
fi
docker run \
-v $HOME/.config/gcloud:/root/.config/gcloud \
-v ${context}:/workspace \
gcr.io/kaniko-project/executor:latest \
/kaniko/executor -d ${tag}