Uploaded image for project: 'Jenkins'
  1. Jenkins
  2. JENKINS-50195

Create a non root user for running Jenkins and the evergreen-client

XMLWordPrintable

    • Evergreen - Milestone 1

      Issue

      Currently the user for Jenkins is still root, we need to fix this and be for instance jenkins before we deliver it to users.

      Expected

      The processes should not running as root.

      We must do like the jenkins/jenkins image in this regard.

          [JENKINS-50195] Create a non root user for running Jenkins and the evergreen-client

          Baptiste Mathus created issue -
          Baptiste Mathus made changes -
          Labels New: essentials
          Baptiste Mathus made changes -
          Epic Link New: JENKINS-49845 [ 188829 ]
          Baptiste Mathus made changes -
          Description Original: h3. Issue
          Currently the user for Jenkins is still {{root}}, we need to fix this and be for instance {{jenkins}} before we deliver it to users.

          h3. Expected
          The processes should *not* running as root.

          We must do like the {{jenkins/jenkins}} image.           		New: h3. Issue
          Currently the user for Jenkins is still {{root}}, we need to fix this and be for instance {{jenkins}} before we deliver it to users.

          h3. Expected
          The processes should *not* running as root.

          We must do like the {{jenkins/jenkins}} image in this regard.

          R. Tyler Croy added a comment -

          I'm assuming the issue here is that the java process is running as root, correct?

          Or are you concerned about supervisord running as root too?

          Assuming it's the first one, supervisord supports dropping permissions when it executes processes, so perhaps we should just update the supervisord.conf to run both java and eventually nodejs as the jenkins user?

          R. Tyler Croy added a comment - I'm assuming the issue here is that the java process is running as root, correct? Or are you concerned about supervisord running as root too? Assuming it's the first one, supervisord supports dropping permissions when it executes processes, so perhaps we should just update the supervisord.conf to run both java and eventually nodejs as the jenkins user?
          R. Tyler Croy made changes -
          Assignee Original: R. Tyler Croy [ rtyler ]

          Baptiste Mathus added a comment -

          Yes, Jenkins right now. And same for evergreen-client once it will exist as a process too.

          I think we should ideally run supervisord in userspace too, if it does not need to be root. 

           

          Baptiste Mathus added a comment - Yes, Jenkins right now. And same for evergreen-client once it will exist as a process too. I think we should ideally run supervisord  in userspace too, if it does not need to be root .   

          R. Tyler Croy added a comment -

          I don't have a good notion right now of whether supervisord needs root or not.

          I'm going to leave this ticket in the backlog, but feel free to pick it up for Milestone 1 if the other stuff gets tackled in good time.

          R. Tyler Croy added a comment - I don't have a good notion right now of whether supervisord needs root or not. I'm going to leave this ticket in the backlog, but feel free to pick it up for Milestone 1 if the other stuff gets tackled in good time.
          Baptiste Mathus made changes -
          Sprint New: Essentials - Milestone 1 [ 511 ]

          Baptiste Mathus added a comment -

          Ack, tagged for current milestone so that it shows up on the board. But ack also to work on it only if others are done. I agree it's not critical to the current phase.

          Baptiste Mathus added a comment - Ack, tagged for current milestone so that it shows up on the board. But ack also to work on it only if others are done. I agree it's not critical to the current phase.

            batmat Baptiste Mathus
            batmat Baptiste Mathus
            Votes:
            0 Vote for this issue
            Watchers:
            2 Start watching this issue

              Created:
              Updated:
              Resolved: