mirror of
https://github.com/moby/buildkit.git
synced 2026-06-30 19:57:39 +00:00
3a91b50be1
Fix issue 5763 - Discourage `--oci-worker-no-process-sandbox`, due to the leakage of the processes (by design). Instead, encourage setting `systempaths=unconfined` in `docker run`. This corresponds to `securityContext.procMount: Unmasked` in Kubernetes, however, the configuration is hard on Kubernetes, as it has to be used in conjunction with `hostUsers: false`. - Remove `--device /dev/fuse`, as fuse-overlayfs is no longer used typically. - Use the new Kubernetes struct for AppArmor - Add a hint about `kernel.apparmor_restrict_unprivileged_userns` - Remove `$` from command snippets for ease of copypasting - Make `job.*.yaml` more practical - Add `*.userns.yaml`. Needs `UserNamespaceSupport` feature gate to be enabled. Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
78 lines
1.8 KiB
YAML
78 lines
1.8 KiB
YAML
# Depends on feature gate UserNamespacesSupport
|
|
apiVersion: apps/v1
|
|
kind: Deployment
|
|
metadata:
|
|
labels:
|
|
app: buildkitd
|
|
name: buildkitd
|
|
spec:
|
|
replicas: 1
|
|
selector:
|
|
matchLabels:
|
|
app: buildkitd
|
|
template:
|
|
metadata:
|
|
labels:
|
|
app: buildkitd
|
|
spec:
|
|
hostUsers: false
|
|
containers:
|
|
- name: buildkitd
|
|
image: moby/buildkit:master
|
|
args:
|
|
- --addr
|
|
- unix:///run/buildkit/buildkitd.sock
|
|
- --addr
|
|
- tcp://0.0.0.0:1234
|
|
- --tlscacert
|
|
- /certs/ca.pem
|
|
- --tlscert
|
|
- /certs/cert.pem
|
|
- --tlskey
|
|
- /certs/key.pem
|
|
# the probe below will only work after Release v0.6.3
|
|
readinessProbe:
|
|
exec:
|
|
command:
|
|
- buildctl
|
|
- debug
|
|
- workers
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 30
|
|
# the probe below will only work after Release v0.6.3
|
|
livenessProbe:
|
|
exec:
|
|
command:
|
|
- buildctl
|
|
- debug
|
|
- workers
|
|
initialDelaySeconds: 5
|
|
periodSeconds: 30
|
|
securityContext:
|
|
# Not really privileged
|
|
privileged: true
|
|
ports:
|
|
- containerPort: 1234
|
|
volumeMounts:
|
|
- name: certs
|
|
readOnly: true
|
|
mountPath: /certs
|
|
volumes:
|
|
# buildkit-daemon-certs must contain ca.pem, cert.pem, and key.pem
|
|
- name: certs
|
|
secret:
|
|
secretName: buildkit-daemon-certs
|
|
---
|
|
apiVersion: v1
|
|
kind: Service
|
|
metadata:
|
|
labels:
|
|
app: buildkitd
|
|
name: buildkitd
|
|
spec:
|
|
ports:
|
|
- port: 1234
|
|
protocol: TCP
|
|
selector:
|
|
app: buildkitd
|