1
0
mirror of https://github.com/tektoncd/catalog.git synced 2024-11-21 05:55:35 +00:00

Set HOME to /tekton/home for nonroot tasks

In an effort to reduce permissions for certain tasks in #1034, the HOME
directory was either set to `/home/nonroot` or was unchanged. This
caused the tasks to fail when being run under limited permissions as
they could not create `/home/nonroot` or write to `/` in some cases.

This commit follows suit with #860 where HOME is set to `/tekton/home`
so that the task can perform actions in it.
This commit is contained in:
Shubham 2022-08-16 18:42:04 +05:30 committed by tekton-robot
parent ef32a32333
commit f99d13e554
5 changed files with 11 additions and 2 deletions

View File

@ -107,7 +107,7 @@ spec:
description: | description: |
Absolute path to the user's home directory. Absolute path to the user's home directory.
type: string type: string
default: "/home/nonroot" default: "/tekton/home"
results: results:
- name: commit - name: commit
description: The precise commit SHA that was fetched by this Task. description: The precise commit SHA that was fetched by this Task.

View File

@ -33,4 +33,4 @@ spec:
runAsUser: 65532 runAsUser: 65532
env: env:
- name: HOME - name: HOME
value: /home/nonroot value: /tekton/home

View File

@ -26,6 +26,9 @@ spec:
- "help" - "help"
steps: steps:
- name: kn - name: kn
env:
- name: HOME
value: /tekton/home
image: "$(params.kn-image)" image: "$(params.kn-image)"
command: ["/ko-app/kn"] command: ["/ko-app/kn"]
args: ["$(params.ARGS)"] args: ["$(params.ARGS)"]

View File

@ -41,6 +41,9 @@ spec:
default: "true" default: "true"
steps: steps:
- name: skopeo-copy - name: skopeo-copy
env:
- name: HOME
value: /tekton/home
image: quay.io/skopeo/stable:v1.9.0 image: quay.io/skopeo/stable:v1.9.0
script: | script: |
# Function to copy multiple images. # Function to copy multiple images.

View File

@ -36,6 +36,9 @@ spec:
default: ["--help"] default: ["--help"]
steps: steps:
- name: tkn - name: tkn
env:
- name: HOME
value: /tekton/home
image: "$(params.TKN_IMAGE)" image: "$(params.TKN_IMAGE)"
script: | script: |
if [ "$(workspaces.kubeconfig.bound)" = "true" ] && [ -e $(workspaces.kubeconfig.path)/kubeconfig ]; then if [ "$(workspaces.kubeconfig.bound)" = "true" ] && [ -e $(workspaces.kubeconfig.path)/kubeconfig ]; then