Skip to content

Commit 3a88b36

Browse files
adrianliechtiadrianliechti
committed
use rootless buildkit
1 parent 0df59e3 commit 3a88b36

5 files changed

Lines changed: 77 additions & 9 deletions

File tree

‎app/build/build.go‎

Lines changed: 52 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ import (
1717
"github.com/adrianliechti/loop/pkg/kubernetes"
1818
"github.com/adrianliechti/loop/pkg/to"
1919

20+
"github.com/Masterminds/semver/v3"
2021
"github.com/google/go-containerregistry/pkg/name"
2122
"github.com/google/uuid"
2223
"github.com/moby/moby/pkg/archive"
@@ -204,11 +205,11 @@ func Run(ctx context.Context, client kubernetes.Client, namespace string, image
204205

205206
data, _ := json.Marshal(config)
206207

207-
if err := client.PodExec(ctx, pod.Namespace, pod.Name, container, []string{"mkdir", "-p", "/root/.docker"}, false, nil, io.Discard, io.Discard); err != nil {
208+
if err := client.PodExec(ctx, pod.Namespace, pod.Name, container, []string{"mkdir", "-p", "/home/user/.docker"}, false, nil, io.Discard, io.Discard); err != nil {
208209
return err
209210
}
210211

211-
if err := client.PodExec(ctx, namespace, name, container, []string{"cp", "/dev/stdin", "/root/.docker/config.json"}, false, bytes.NewReader(data), io.Discard, io.Discard); err != nil {
212+
if err := client.PodExec(ctx, namespace, name, container, []string{"cp", "/dev/stdin", "/home/user/.docker/config.json"}, false, bytes.NewReader(data), io.Discard, io.Discard); err != nil {
212213
return err
213214
}
214215
}
@@ -244,7 +245,13 @@ func Run(ctx context.Context, client kubernetes.Client, namespace string, image
244245

245246
func startPod(ctx context.Context, client kubernetes.Client, namespace, name, image string) (*corev1.Pod, error) {
246247
if image == "" {
247-
image = "moby/buildkit"
248+
image = "moby/buildkit:rootless"
249+
}
250+
251+
version, err := client.Version(ctx)
252+
253+
if err != nil {
254+
return nil, err
248255
}
249256

250257
probe := &corev1.Probe{
@@ -275,19 +282,61 @@ func startPod(ctx context.Context, client kubernetes.Client, namespace, name, im
275282
Image: image,
276283
ImagePullPolicy: corev1.PullAlways,
277284

285+
Args: []string{
286+
"--oci-worker-no-process-sandbox",
287+
},
288+
278289
SecurityContext: &corev1.SecurityContext{
279290
Privileged: to.Ptr(true),
291+
292+
AppArmorProfile: &corev1.AppArmorProfile{
293+
Type: corev1.AppArmorProfileTypeUnconfined,
294+
},
295+
296+
SeccompProfile: &corev1.SeccompProfile{
297+
Type: corev1.SeccompProfileTypeUnconfined,
298+
},
299+
300+
RunAsUser: to.Ptr(int64(1000)),
301+
RunAsGroup: to.Ptr(int64(1000)),
280302
},
281303

282304
ReadinessProbe: probe,
283305
LivenessProbe: probe,
306+
307+
VolumeMounts: []corev1.VolumeMount{
308+
{
309+
Name: "data",
310+
MountPath: "/home/user/.local/share/buildkit",
311+
},
312+
},
284313
},
285314
},
286315

287316
TerminationGracePeriodSeconds: to.Ptr(int64(10)),
317+
318+
Volumes: []corev1.Volume{
319+
{
320+
Name: "data",
321+
VolumeSource: corev1.VolumeSource{
322+
EmptyDir: &corev1.EmptyDirVolumeSource{},
323+
},
324+
},
325+
},
288326
},
289327
}
290328

329+
c, _ := semver.NewConstraint("< 1.30")
330+
331+
if c.Check(version) {
332+
if pod.Annotations == nil {
333+
pod.Annotations = map[string]string{}
334+
}
335+
336+
pod.Spec.Containers[0].SecurityContext.AppArmorProfile = nil
337+
pod.Annotations["container.apparmor.security.beta.kubernetes.io/buildkitd"] = "unconfined"
338+
}
339+
291340
if _, err := client.CoreV1().Pods(namespace).Create(ctx, pod, metav1.CreateOptions{}); err != nil {
292341
return nil, err
293342
}

‎go.mod‎

Lines changed: 3 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,7 @@ go 1.23.0
55
toolchain go1.23.4
66

77
require (
8+
github.com/Masterminds/semver/v3 v3.3.1
89
github.com/charmbracelet/huh v0.6.0
910
github.com/charmbracelet/lipgloss v1.0.0
1011
github.com/gliderlabs/ssh v0.3.8
@@ -17,9 +18,9 @@ require (
1718
github.com/pkg/sftp v1.13.7
1819
github.com/urfave/cli/v3 v3.0.0-alpha9.7
1920
golang.org/x/crypto v0.31.0
20-
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67
21+
golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329
2122
golang.org/x/sync v0.10.0
22-
golang.org/x/sys v0.28.0
23+
golang.org/x/sys v0.29.0
2324
k8s.io/api v0.32.0
2425
k8s.io/apiextensions-apiserver v0.32.0
2526
k8s.io/apimachinery v0.32.0

‎go.sum‎

Lines changed: 6 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,8 @@ github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25
44
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
55
github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
66
github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
7+
github.com/Masterminds/semver/v3 v3.3.1 h1:QtNSWtVZ3nBfk8mAOu/B6v7FMJ+NHTIgUPi7rj+4nv4=
8+
github.com/Masterminds/semver/v3 v3.3.1/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM=
79
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be h1:9AeTilPcZAjCFIImctFaOjnTIavg87rW78vTPkQqLI8=
810
github.com/anmitsu/go-shlex v0.0.0-20200514113438-38f4b401e2be/go.mod h1:ySMOLuWl6zY27l47sB3qLNK6tF2fkHG55UZxx8oIVo4=
911
github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
@@ -190,8 +192,8 @@ golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5y
190192
golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4=
191193
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
192194
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
193-
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67 h1:1UoZQm6f0P/ZO0w1Ri+f+ifG/gXhegadRdwBIXEFWDo=
194-
golang.org/x/exp v0.0.0-20241217172543-b2144cdd0a67/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
195+
golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329 h1:9kj3STMvgqy3YA4VQXBrN7925ICMxD5wzMRcgA30588=
196+
golang.org/x/exp v0.0.0-20250103183323-7d7fa50e5329/go.mod h1:qj5a5QZpwLU2NLQudwIN5koi3beDhSAlJwa67PuM98c=
195197
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
196198
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
197199
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
@@ -230,8 +232,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
230232
golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
231233
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
232234
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
233-
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
234-
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
235+
golang.org/x/sys v0.29.0 h1:TPYlXGxvx1MGTn2GiZDhnjPA9wZzZeGKHHmKhHYvgaU=
236+
golang.org/x/sys v0.29.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
235237
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
236238
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
237239
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=

‎pkg/kubernetes/kubernetes.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,8 @@ import (
66
"os"
77
"path/filepath"
88

9+
"github.com/Masterminds/semver/v3"
10+
911
corev1 "k8s.io/api/core/v1"
1012
"k8s.io/apimachinery/pkg/runtime/schema"
1113
"k8s.io/client-go/dynamic"
@@ -32,6 +34,8 @@ type Client interface {
3234
Namespace() string
3335
Credentials() (*Credentials, error)
3436

37+
Version(ctx context.Context) (*semver.Version, error)
38+
3539
Apply(ctx context.Context, namespace string, reader io.Reader) error
3640
ApplyFile(ctx context.Context, namespace string, path string) error
3741
ApplyURL(ctx context.Context, namespace string, url string) error

‎pkg/kubernetes/kubernetes_info.go‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -6,10 +6,22 @@ import (
66
"net"
77
"regexp"
88

9+
"github.com/Masterminds/semver/v3"
10+
911
corev1 "k8s.io/api/core/v1"
1012
metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
1113
)
1214

15+
func (c *client) Version(ctx context.Context) (*semver.Version, error) {
16+
version, err := c.Discovery().ServerVersion()
17+
18+
if err != nil {
19+
return nil, err
20+
}
21+
22+
return semver.NewVersion(version.GitVersion)
23+
}
24+
1325
func (c *client) PodCIDR(ctx context.Context) (string, error) {
1426
nodes, err := c.CoreV1().Nodes().List(ctx, metav1.ListOptions{})
1527

0 commit comments

Comments
 (0)