Re: Securely insert ssh keys into Jenkins Docker image

2017-01-06 Thread Barry Laffoy
I have my own Dockerfile for some further configuration anyway, so this version suits me. It would be nice to be able to set the uid at build or run time, but I can't see how one might achieve that, given the fundamentals of how Jenkins and Docker work. On Friday, 6 January 2017 02:20:55 UTC,

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-05 Thread Dan Tran
I would prefer to clone the repo and build the container, this way I do not have maintain my own jenkins image Maybe Jenkins dev can allow options to run the container using user prefer Ids? Thanks -Dan On Thursday, January 5, 2017 at 3:37:54 AM UTC-8, Barry Laffoy wrote: > > If this is of us

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-05 Thread Barry Laffoy
If this is of use to anybody else, I was able to workaround this implementation problem in the jenkinsci/docker with the following: FROM jenkins:2.19.4 ARG user=jenkins ARG group=jenkins ARG olduid=1000 ARG oldgid=1000 ARG uid ARG gid ENV JENKINS_HOME /var/lib/jenkins ENV COPY_REFERENCE_FILE_LOG

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-04 Thread Barry Laffoy
Dirk Heinrichs' comments have made me realise that this problem goes both ways. Since my host has a user with uid 1000, the data volume on the host at, say, /var/lib/docker/volumes/6a70b50dc1c6d201bd772e8d4bf8cb17d9668fbed0661e27b5fcf7d6b7847070/_data is actually owned by that host user. What

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-04 Thread Barry Laffoy
Aha, I understand what you're saying now. There is such a user on both the development and the production hosts I'm using, unfortunately. I'll investigate what can be done to change that. On Wednesday, 4 January 2017 08:44:45 UTC, Dirk Heinrichs wrote: > > Am 04.01.2017 um 09:35 schrieb Barry La

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-04 Thread Dirk Heinrichs
Am 04.01.2017 um 09:35 schrieb Barry Laffoy: > Thanks for the response, but I think I must be missing a trick because > I don't know what you're getting at. > > If say, the uid of the host user is 1005, and the uid of the > container's jenkins user is 1000, these clearly don't match. I would > nee

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-04 Thread Barry Laffoy
> > one I think would be nice is one that basically takes an SSH_AGENT from > the Jenkins user and exposes its keys as SSH keys (so good an idea I may > implement it myself... if I get spare time or if my employer agrees it is a > good idea) > In my reading I came across some references to mou

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-04 Thread Barry Laffoy
> > Well, then let it match. Or do you need it on the host? > > HTH... > > Dirk > Thanks for the response, but I think I must be missing a trick because I don't know what you're getting at. If say, the uid of the host user is 1005, and the uid of the container's jenkins user is 1000, thes

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-03 Thread Dirk Heinrichs
Am 03.01.2017 um 15:21 schrieb Barry Laffoy: > Mounting the key location as volume with `docker run -v > /path/to/keys:/var/jenkins_home/.ssh` does not work, as the mount > point in the container inherits the uid/gid of the host directory, > which does not match the uid/gid of the "jenkins" user wi

Re: Securely insert ssh keys into Jenkins Docker image

2017-01-03 Thread Stephen Connolly
there are two other options: 1. Bake the secret key used to encrypt Jenkins secrets into your image (downside, anyone with access to the image can decrypt they keys) 2. Seed the JENKINS_HOME volume with unencrypted credentials.xml and have an init.groovy.d script trigger a save (which will encryp

Securely insert ssh keys into Jenkins Docker image

2017-01-03 Thread Barry Laffoy
Hi I'm trying to set-up our Jenkins master in a reproducible way using the Docker image here: https://github.com/jenkinsci/docker One problem I am having is how to make ssh private keys (e.g. for polling git repos) available within the container in a secure manner. Ideally, I would like to be