Jenkins：使用Docker作为构建环境的权限问题

我在Ubuntu 16.04机器上安装了Jenkins。Jenkins本身不在容器中运行。我要做的只是yarn install使用节点图像进行调用。这是我的Jenkinsfile：

pipeline {
    agent any
    stages {
        stage('install node modules...') {
            agent { docker 'node' }
            steps {
                sh 'cd /path/to/package.json; yarn install'
            }
        }
    }
}

很简单吧？

jenkins用户/组为112:116，节点容器的uid为1000，因此yarn进程（作为节点用户1000运行）无法执行其操作，例如mkdir /.config。

我试图旋转传入参数的节点容器-u 1000，在尝试创建持久目录时遇到了权限问题。

看起来像是另一种问题，我该如何解决？

詹金斯日志：

下面是构建开始和失败的地方。

[Pipeline] sh
[Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2] Running shell script
+ docker inspect -f . node
.
[Pipeline] withDockerContainer
Jenkins does not seem to be running inside a container
$ docker run -t -d -u 112:116 -w /var/lib/jenkins/workspace/Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2 -v /var/lib/jenkins/workspace/Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2:/var/lib/jenkins/workspace/Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2:rw,z -v /var/lib/jenkins/workspace/Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2@tmp:/var/lib/jenkins/workspace/Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2@tmp:rw,z -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** --entrypoint cat node
[Pipeline] {
[Pipeline] sh
[Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2] Running shell script
+ cd /path/to/package.json
+ yarn install
yarn install v0.24.6
error An unexpected error occurred: "EACCES: permission denied, mkdir '/.config'".
info If you think this is a bug, please open a bug report with the information provided in "/var/lib/jenkins/workspace/Pipeline_Test_Jenkins_test-4JTFYMX7KSJY6ZH44VINNGEB7WH2D2HWYZN5ABF6O32O2HBQJYXQ@2/<path>/yarn-error.log".
info Visit https://yarnpkg.com/en/docs/cli/install for documentation about this command.
[Pipeline] }
$ docker stop --time=1 c1147934ea689f71a449e486282db03338b12182368def31bdf8e8cf179ab46a
$ docker rm -f c1147934ea689f71a449e486282db03338b12182368def31bdf8e8cf179ab46a
[Pipeline] // withDockerContainer
[Pipeline] }
[Pipeline] // node
[Pipeline] }
[Pipeline] // stage
[Pipeline] }
[Pipeline] // node
[Pipeline] End of Pipeline
ERROR: script returned exit code 1
Finished: FAILURE

我在节点上遇到了同样的问题。问题是容器中的文件归“ root：root”所有。尝试添加docker args -u root:root：

docker { 
    image 'node:8'
    args '-u root:root'
}

我今天有一个类似的问题，尽管有另一个图像。

docker {
 image 'node:8'
 args '--tmpfs /.config'
}

参考：https : //docs.docker.com/storage/tmpfs/这样，您不必担心在詹金斯内部销毁容器后是否存在任何安全漏洞或文件。

buildEnv.inside("-u 0") {}解决了我的问题。但是，工作区将包含root拥有的目录和文件，Jenkins在清理workpace时在下次运行时无法删除它们，因此我sh "sudo chown jenkins: -R \$PWD/" 在管道的开头添加了该目录和文件 。