diff --git a/Makefile b/Makefile index 24f5b5b79..027e64a92 100644 --- a/Makefile +++ b/Makefile @@ -35,7 +35,7 @@ EXECUTOR_PACKAGE = $(REPOPATH)/executor KANIKO_PROJECT = $(REPOPATH)/kaniko out/executor: $(GO_FILES) - GOOS=$* GOARCH=$(GOARCH) CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(EXECUTOR_PACKAGE) + GOARCH=$(GOARCH) GOOS=linux CGO_ENABLED=0 go build -ldflags $(GO_LDFLAGS) -tags $(GO_BUILD_TAGS) -o $@ $(EXECUTOR_PACKAGE) out/kaniko: $(GO_FILES) @@ -52,3 +52,11 @@ integration-test: out/executor out/kaniko .PHONY: images images: out/executor out/kaniko docker build -t $(REGISTRY)/executor:latest -f deploy/Dockerfile . + +.PHONY: run-in-docker +run-in-docker: images + docker run \ + -v $(HOME)/.config/gcloud:/root/.config/gcloud \ + -v $(GOOGLE_APPLICATION_CREDENTIALS):$(GOOGLE_APPLICATION_CREDENTIALS) \ + -e GOOGLE_APPLICATION_CREDENTIALS=$(GOOGLE_APPLICATION_CREDENTIALS) \ + $(REGISTRY)/executor:latest diff --git a/README.md b/README.md index 93f4a9d57..b8fec6fae 100644 --- a/README.md +++ b/README.md @@ -1,36 +1,100 @@ # kaniko -kaniko is a tool to build container images from a Dockerfile without a Docker daemon. This enables building container images in unpriviliged environments, which can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. +kaniko is a tool to build unpriviliged container images from a Dockerfile. It doesn't depend on a Docker daemon, which enables building container images in environments that can't easily or securely run a Docker daemon, such as a standard Kubernetes cluster. The majority of Dockerfile commands can be executed with kaniko, but we're still working on supporting the following commands: * ADD + * VOLUME * SHELL * HEALTHCHECK * STOPSIGNAL * ONBUILD * ARG - * VOLUME We're currently in the process of building kaniko, so as of now it isn't production ready. Please let us know if you have any feature requests or find any bugs! +## How does it work? + +The kaniko executor image is responsible for building the final image from a Dockerfile and pushing it to a registry. Within the executor image, we extract the filesystem of the base image (the FROM image in the Dockerfile). We then execute the commands in the Dockerfile, snapshotting the filesystem in userspace after each one. After each command, we append a layer of changed files to the base image (if there are any) and update image metadata. + +## kaniko Build Context +kaniko supports local directories and GCS buckets as build contexts. To specify a local directory, pass in the `--context=` flag as an argument to the executor image. To specify a GCS bucket, pass in the `--bucket=` flag. The GCS bucket should contain a compressed tar of the build context called `context.tar.gz`, which kaniko will unpack and use as the build context. + +To easily create `context.tar.gz`, we can use [skaffold](https://github.com/GoogleCloudPlatform/skaffold). + +Running `skaffold docker context` will create `context.tar.gz`, which will contain the Dockerfile and any files it depends on. + +We can copy over the compressed tar with gsutil: +`gsutil cp context.tar.gz gs://` + +## Running kaniko locally + +Requirements: + * Docker + * gcloud + +We can run the kaniko executor image locally in a Docker daemon to build and push an image from a Dockerfile. + +First, to build the executor image locally, run `make images`. This will load the executor image into your Docker daemon. + +To run kaniko in Docker, run the following command: +`./run_in_docker.sh ` + ## Running kaniko in a Kubernetes cluster -kaniko runs as an image, which is responsible for building the final image from a Dockerfile and pushing it to a GCR registry. +Requirements: + * Standard Kubernetes cluster + * Kubernetes Secret + +To run kaniko in a Kubernetes cluster, you will need a standard running Kubernetes cluster and a Kubernetes secret, which contains the auth required to push the final image. -`make images` +To create the secret, first you will need to create a service account in the Pantheon project you want to push the final image to, with `Storage Admin` permissions. You can download a JSON key for this service account, and rename it `kaniko-secret.json`. To create the secret, run: -The image takes in three arguments: a path to a Dockerfile, a path to a build context, and the GCR registry the final image should be pushed to (in the form gcr.io/$PROJECT/$IMAGE:$TAG) +`kubectl create secret generic kaniko-secret --from-file=` +The Kubernetes job.yaml should look similar to this, with the args parameters filled in: -## Comparison with Other Tools +```yaml +apiVersion: batch/v1 +kind: Job +metadata: + name: kaniko +spec: + template: + spec: + containers: + - name: kaniko + image: gcr.io/kaniko-project/executor:latest + args: ["--dockerfile=", "--bucket=", "--destination="] + volumeMounts: + - name: kaniko-secret + mountPath: /secret + env: + - name: GOOGLE_APPLICATION_CREDENTIALS + value: /secret/kaniko-secret.json + restartPolicy: Never + volumes: + - name: kaniko-secret + secret: + secretName: kaniko-secret +``` + +This example pulls the build context from a GCS bucket. To use a local directory build context, you could consider using configMaps to mount in small build context. + +## Comparison with Other Tools/Solutions Similar tools include: * [img](https://github.com/genuinetools/img) * [orca-build](https://github.com/cyphar/orca-build) * [buildah](https://github.com/projectatomic/buildah) + * [Bazel](https://github.com/bazelbuild/rules_docker)/[FTL](https://github.com/GoogleCloudPlatform/runtimes-common/tree/master/ftl) All of these tools build container images; however, the way in which they accomplish this differs from kaniko. Both kaniko and img build unprivileged images, but they interpret “unprivileged” differently. img builds as a non root user from within the container, while kaniko is run in an unprivileged environment with root access inside the container. Unlike orca-build, kaniko doesn't use runC to build images. Instead, it runs as a root user within the container. buildah requires the same root privilges as a Docker daemon does to run, while kaniko runs without any special privileges or permissions. + +Bazel/FTL aim to improve DevEx by achieving the fastest possible creation of Docker images, at the expense of build compatibility. By restricting the set of allowed builds to an optimizable subset, we get the nice side effect of being able to run without privileges inside an arbitrary cluster. + +These approaches can be thought of as special-case "fast paths" that can be used in conjunction with the support for general Dockerfile kaniko provides. diff --git a/deploy/Dockerfile b/deploy/Dockerfile index ef43f79e1..c2645620c 100644 --- a/deploy/Dockerfile +++ b/deploy/Dockerfile @@ -19,5 +19,6 @@ ADD out/executor /kaniko/executor ADD files/ca-certificates.crt /etc/ssl/certs/ ADD files/docker-credential-gcr /usr/local/bin/ ADD files/config.json /root/.docker/ +RUN ["docker-credential-gcr", "config", "--token-source=env"] ENV HOME /root ENV PATH /usr/local/bin diff --git a/examples/kubernetes/job.yaml b/examples/kubernetes/job.yaml new file mode 100644 index 000000000..3dd45ac79 --- /dev/null +++ b/examples/kubernetes/job.yaml @@ -0,0 +1,22 @@ +apiVersion: batch/v1 +kind: Job +metadata: + name: kbuild-demo +spec: + template: + spec: + containers: + - name: init-static + image: gcr.io/priya-wadhwa/executor:latest + command: ["/work-dir/executor", "--context=kbuild-demo", "--name=gcr.io/priya-wadhwa/kbuild:example", "--dockerfile=/workspace/Dockerfile"] + volumeMounts: + - name: dockerfile-volume + mountPath: /workspace/ + restartPolicy: Never + volumes: + - name: dockerfile-volume + configMap: + name: dockerfile-config + items: + - key: Dockerfile + path: Dockerfile diff --git a/integration_tests/dockerfiles/Dockerfile_test_user_run b/integration_tests/dockerfiles/Dockerfile_test_user_run new file mode 100644 index 000000000..a71fb535e --- /dev/null +++ b/integration_tests/dockerfiles/Dockerfile_test_user_run @@ -0,0 +1,19 @@ +# Copyright 2018 Google, Inc. All rights reserved. +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +FROM gcr.io/google-appengine/debian9 +RUN useradd testuser +RUN groupadd testgroup +USER testuser:testgroup +RUN echo "hey" > /tmp/foo diff --git a/integration_tests/dockerfiles/Dockerfile_test_workdir b/integration_tests/dockerfiles/Dockerfile_test_workdir new file mode 100644 index 000000000..6c89e4c11 --- /dev/null +++ b/integration_tests/dockerfiles/Dockerfile_test_workdir @@ -0,0 +1,13 @@ +FROM gcr.io/google-appengine/debian9:latest +COPY context/foo foo +WORKDIR /test +# Test that this will be appended on to the previous command, to create /test/workdir +WORKDIR workdir +COPY context/foo ./currentfoo +# Test that the RUN command will happen in the correct directory +RUN cp currentfoo newfoo +WORKDIR /new/dir +ENV dir /another/new/dir +WORKDIR $dir/newdir +WORKDIR $dir/$doesntexist +WORKDIR / diff --git a/integration_tests/dockerfiles/config_test_workdir.json b/integration_tests/dockerfiles/config_test_workdir.json new file mode 100644 index 000000000..3b3fcefab --- /dev/null +++ b/integration_tests/dockerfiles/config_test_workdir.json @@ -0,0 +1,12 @@ +[ + { + "Image1": "gcr.io/kaniko-test/docker-test-workdir:latest", + "Image2": "gcr.io/kaniko-test/kaniko-test-workdir:latest", + "DiffType": "File", + "Diff": { + "Adds": null, + "Dels": null, + "Mods": null + } + } +] \ No newline at end of file diff --git a/integration_tests/dockerfiles/test_user.yaml b/integration_tests/dockerfiles/test_user.yaml new file mode 100644 index 000000000..9a4bed1dc --- /dev/null +++ b/integration_tests/dockerfiles/test_user.yaml @@ -0,0 +1,15 @@ +schemaVersion: '2.0.0' +commandTests: +- name: 'whoami' + command: 'whoami' + expectedOutput: ['testuser'] + excludedOutput: ['root'] +- name: 'file owner' + command: 'ls' + args: ['-l', '/tmp/foo'] + expectedOutput: ['.*testuser.*', '.*testgroup.*'] + excludedOutput: ['.*root.*'] +fileContentTests: +- name: "/tmp/foo" + path: "/tmp/foo" + expectedContent: ["hey"] diff --git a/integration_tests/integration_test_yaml.go b/integration_tests/integration_test_yaml.go index f5857c228..2a132a741 100644 --- a/integration_tests/integration_test_yaml.go +++ b/integration_tests/integration_test_yaml.go @@ -57,6 +57,13 @@ var fileTests = []struct { context: "/workspace/integration_tests/", repo: "test-copy", }, + { + description: "test workdir", + dockerfilePath: "/workspace/integration_tests/dockerfiles/Dockerfile_test_workdir", + configPath: "/workspace/integration_tests/dockerfiles/config_test_workdir.json", + context: "/workspace/integration_tests/", + repo: "test-workdir", + }, } var structureTests = []struct { @@ -80,6 +87,13 @@ var structureTests = []struct { dockerBuildContext: "/workspace/integration_tests/dockerfiles/", structureTestYamlPath: "/workspace/integration_tests/dockerfiles/test_metadata.yaml", }, + { + description: "test user command", + dockerfilePath: "/workspace/integration_tests/dockerfiles/Dockerfile_test_user_run", + repo: "test-user", + dockerBuildContext: "/workspace/integration_tests/dockerfiles/", + structureTestYamlPath: "/workspace/integration_tests/dockerfiles/test_user.yaml", + }, } type step struct { diff --git a/pkg/commands/commands.go b/pkg/commands/commands.go index 08fa3ceb1..0376d225a 100644 --- a/pkg/commands/commands.go +++ b/pkg/commands/commands.go @@ -44,12 +44,16 @@ func GetCommand(cmd instructions.Command, buildcontext string) (DockerCommand, e return &ExposeCommand{cmd: c}, nil case *instructions.EnvCommand: return &EnvCommand{cmd: c}, nil + case *instructions.WorkdirCommand: + return &WorkdirCommand{cmd: c}, nil case *instructions.CmdCommand: return &CmdCommand{cmd: c}, nil case *instructions.EntrypointCommand: return &EntrypointCommand{cmd: c}, nil case *instructions.LabelCommand: return &LabelCommand{cmd: c}, nil + case *instructions.UserCommand: + return &UserCommand{cmd: c}, nil } return nil, errors.Errorf("%s is not a supported command", cmd.Name()) } diff --git a/pkg/commands/expose.go b/pkg/commands/expose.go index fa12ec110..fc9d6fe75 100644 --- a/pkg/commands/expose.go +++ b/pkg/commands/expose.go @@ -30,6 +30,7 @@ type ExposeCommand struct { } func (r *ExposeCommand) ExecuteCommand(config *manifest.Schema2Config) error { + logrus.Info("cmd: EXPOSE") // Grab the currently exposed ports existingPorts := config.ExposedPorts // Add any new ones in diff --git a/pkg/commands/label.go b/pkg/commands/label.go index 3cf8896db..81b9bab56 100644 --- a/pkg/commands/label.go +++ b/pkg/commands/label.go @@ -29,6 +29,7 @@ type LabelCommand struct { } func (r *LabelCommand) ExecuteCommand(config *manifest.Schema2Config) error { + logrus.Info("cmd: LABEL") return updateLabels(r.cmd.Labels, config) } diff --git a/pkg/commands/run.go b/pkg/commands/run.go index b08cf8800..6be8f33fe 100644 --- a/pkg/commands/run.go +++ b/pkg/commands/run.go @@ -22,7 +22,9 @@ import ( "github.com/sirupsen/logrus" "os" "os/exec" + "strconv" "strings" + "syscall" ) type RunCommand struct { @@ -44,7 +46,28 @@ func (r *RunCommand) ExecuteCommand(config *manifest.Schema2Config) error { logrus.Infof("args: %s", newCommand[1:]) cmd := exec.Command(newCommand[0], newCommand[1:]...) + cmd.Dir = config.WorkingDir cmd.Stdout = os.Stdout + // If specified, run the command as a specific user + if config.User != "" { + userAndGroup := strings.Split(config.User, ":") + // uid and gid need to be uint32 + uid64, err := strconv.ParseUint(userAndGroup[0], 10, 32) + if err != nil { + return err + } + uid := uint32(uid64) + var gid uint32 + if len(userAndGroup) > 1 { + gid64, err := strconv.ParseUint(userAndGroup[1], 10, 32) + if err != nil { + return err + } + gid = uint32(gid64) + } + cmd.SysProcAttr = &syscall.SysProcAttr{} + cmd.SysProcAttr.Credential = &syscall.Credential{Uid: uid, Gid: gid} + } return cmd.Run() } diff --git a/pkg/commands/user.go b/pkg/commands/user.go new file mode 100644 index 000000000..d2e4cff61 --- /dev/null +++ b/pkg/commands/user.go @@ -0,0 +1,95 @@ +/* +Copyright 2018 Google LLC + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package commands + +import ( + "github.com/GoogleCloudPlatform/k8s-container-builder/pkg/util" + "github.com/containers/image/manifest" + "github.com/docker/docker/builder/dockerfile/instructions" + "github.com/sirupsen/logrus" + "os/user" + "strings" +) + +type UserCommand struct { + cmd *instructions.UserCommand +} + +func (r *UserCommand) ExecuteCommand(config *manifest.Schema2Config) error { + logrus.Info("cmd: USER") + u := r.cmd.User + userAndGroup := strings.Split(u, ":") + userStr, err := util.ResolveEnvironmentReplacement(userAndGroup[0], config.Env, false) + if err != nil { + return err + } + var groupStr string + if len(userAndGroup) > 1 { + groupStr, err = util.ResolveEnvironmentReplacement(userAndGroup[1], config.Env, false) + if err != nil { + return err + } + } + + // Lookup by username + userObj, err := user.Lookup(userStr) + if err != nil { + if _, ok := err.(user.UnknownUserError); ok { + // Lookup by id + userObj, err = user.LookupId(userStr) + if err != nil { + return err + } + } else { + return err + } + } + + // Same dance with groups + var group *user.Group + if groupStr != "" { + group, err = user.LookupGroup(groupStr) + if err != nil { + if _, ok := err.(user.UnknownGroupError); ok { + group, err = user.LookupGroupId(groupStr) + if err != nil { + return err + } + } else { + return err + } + } + } + + uid := userObj.Uid + if group != nil { + uid = uid + ":" + group.Gid + } + + logrus.Infof("Setting user to %s", uid) + config.User = uid + return nil +} + +func (r *UserCommand) FilesToSnapshot() []string { + return []string{} +} + +func (r *UserCommand) CreatedBy() string { + s := []string{r.cmd.Name(), r.cmd.User} + return strings.Join(s, " ") +} diff --git a/pkg/commands/user_test.go b/pkg/commands/user_test.go new file mode 100644 index 000000000..c1ebe0ab2 --- /dev/null +++ b/pkg/commands/user_test.go @@ -0,0 +1,98 @@ +/* +Copyright 2018 Google LLC + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package commands + +import ( + "github.com/GoogleCloudPlatform/k8s-container-builder/testutil" + "github.com/containers/image/manifest" + "github.com/docker/docker/builder/dockerfile/instructions" + "testing" +) + +var userTests = []struct { + user string + expectedUid string + shouldError bool +}{ + { + user: "root", + expectedUid: "0", + shouldError: false, + }, + { + user: "0", + expectedUid: "0", + shouldError: false, + }, + { + user: "fakeUser", + expectedUid: "", + shouldError: true, + }, + { + user: "root:root", + expectedUid: "0:0", + shouldError: false, + }, + { + user: "0:root", + expectedUid: "0:0", + shouldError: false, + }, + { + user: "root:0", + expectedUid: "0:0", + shouldError: false, + }, + { + user: "0:0", + expectedUid: "0:0", + shouldError: false, + }, + { + user: "root:fakeGroup", + expectedUid: "", + shouldError: true, + }, + { + user: "$envuser", + expectedUid: "0", + shouldError: false, + }, + { + user: "root:$envgroup", + expectedUid: "0:0", + shouldError: false, + }, +} + +func TestUpdateUser(t *testing.T) { + for _, test := range userTests { + cfg := &manifest.Schema2Config{ + Env: []string{ + "envuser=root", + "envgroup=root", + }, + } + cmd := UserCommand{ + &instructions.UserCommand{ + User: test.user, + }, + } + err := cmd.ExecuteCommand(cfg) + testutil.CheckErrorAndDeepEqual(t, test.shouldError, err, test.expectedUid, cfg.User) + } +} diff --git a/pkg/commands/workdir.go b/pkg/commands/workdir.go new file mode 100644 index 000000000..f249608ac --- /dev/null +++ b/pkg/commands/workdir.go @@ -0,0 +1,58 @@ +/* +Copyright 2018 Google LLC + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ + +package commands + +import ( + "github.com/GoogleCloudPlatform/k8s-container-builder/pkg/util" + "github.com/containers/image/manifest" + "github.com/docker/docker/builder/dockerfile/instructions" + "github.com/sirupsen/logrus" + "os" + "path/filepath" +) + +type WorkdirCommand struct { + cmd *instructions.WorkdirCommand + snapshotFiles []string +} + +func (w *WorkdirCommand) ExecuteCommand(config *manifest.Schema2Config) error { + logrus.Info("cmd: workdir") + workdirPath := w.cmd.Path + resolvedWorkingDir, err := util.ResolveEnvironmentReplacement(workdirPath, config.Env, true) + if err != nil { + return err + } + if filepath.IsAbs(resolvedWorkingDir) { + config.WorkingDir = resolvedWorkingDir + } else { + config.WorkingDir = filepath.Join(config.WorkingDir, resolvedWorkingDir) + } + logrus.Infof("Changed working directory to %s", config.WorkingDir) + w.snapshotFiles = []string{config.WorkingDir} + return os.MkdirAll(config.WorkingDir, 0755) +} + +// FilesToSnapshot returns the workingdir, which should have been created if it didn't already exist +func (w *WorkdirCommand) FilesToSnapshot() []string { + return w.snapshotFiles +} + +// CreatedBy returns some information about the command for the image config history +func (w *WorkdirCommand) CreatedBy() string { + return w.cmd.Name() + " " + w.cmd.Path +} diff --git a/pkg/commands/workdir_test.go b/pkg/commands/workdir_test.go new file mode 100644 index 000000000..439d77fd5 --- /dev/null +++ b/pkg/commands/workdir_test.go @@ -0,0 +1,83 @@ +/* +Copyright 2018 Google LLC + +Licensed under the Apache License, Version 2.0 (the "License"); +you may not use this file except in compliance with the License. +You may obtain a copy of the License at + + http://www.apache.org/licenses/LICENSE-2.0 + +Unless required by applicable law or agreed to in writing, software +distributed under the License is distributed on an "AS IS" BASIS, +WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +See the License for the specific language governing permissions and +limitations under the License. +*/ +package commands + +import ( + "github.com/GoogleCloudPlatform/k8s-container-builder/testutil" + "github.com/containers/image/manifest" + "github.com/docker/docker/builder/dockerfile/instructions" + "testing" +) + +// Each test here changes the same WorkingDir field in the config +// So, some of the tests build off of each other +// This is needed to make sure WorkingDir handles paths correctly +// For example, if WORKDIR specifies a non-absolute path, it should be appended to the current WORKDIR +var workdirTests = []struct { + path string + expectedPath string +}{ + { + path: "/a", + expectedPath: "/a", + }, + { + path: "b", + expectedPath: "/a/b", + }, + { + path: "c", + expectedPath: "/a/b/c", + }, + { + path: "/d", + expectedPath: "/d", + }, + { + path: "$path", + expectedPath: "/d/usr", + }, + { + path: "$home", + expectedPath: "/root", + }, + { + path: "$path/$home", + expectedPath: "/root/usr/root", + }, +} + +func TestWorkdirCommand(t *testing.T) { + + cfg := &manifest.Schema2Config{ + WorkingDir: "/", + Env: []string{ + "path=usr/", + "home=/root", + }, + } + + for _, test := range workdirTests { + cmd := WorkdirCommand{ + cmd: &instructions.WorkdirCommand{ + Path: test.path, + }, + snapshotFiles: []string{}, + } + cmd.ExecuteCommand(cfg) + testutil.CheckErrorAndDeepEqual(t, false, nil, test.expectedPath, cfg.WorkingDir) + } +} diff --git a/run_in_docker.sh b/run_in_docker.sh new file mode 100755 index 000000000..edf1b8e1a --- /dev/null +++ b/run_in_docker.sh @@ -0,0 +1,35 @@ +# Copyright 2018 Google LLC +# +# Licensed under the Apache License, Version 2.0 (the "License"); +# you may not use this file except in compliance with the License. +# You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. + +#!/bin/bash +set -e + +if [ $# -ne 3 ]; + then echo "Usage: run_in_docker.sh " +fi + +dockerfile=$1 +context=$2 +tag=$3 + +if [[ ! -e $HOME/.config/gcloud/application_default_credentials.json ]]; then + echo "Application Default Credentials do not exist. Run [gcloud auth application-default login] to configure them" + exit 1 +fi + +docker run \ + -v $HOME/.config/gcloud:/root/.config/gcloud \ + -v ${context}:/workspace \ + gcr.io/kaniko-project/executor:latest \ + /kaniko/executor -d ${tag}