feat(images): build on rootless BuildKit over mTLS; verification moves into Containerfile verify stages
Operator decision on PR #81: no CI job may reach a privileged daemon. The act runner is untouched. - platform/buildkit (+ clusters/base/buildkit.yaml): moby/buildkit v0.34.1-rootless pinned by digest, uid 1000, not privileged; caps drop ALL + SETUID/SETGID, seccomp/AppArmor Unconfined, read-only rootfs (each measured under podman). cert-manager CA + server/client certs, ClusterIP :1234, default-deny with ingress only from the act-runner pod (DinD masquerades jobs to it). No Kyverno exception: every applied policy matches app-namespace=true only. - Each Containerfile names its shipped stage and ends in a `verify` stage holding every former `docker run` assertion (uid 65532, RUN --network=none, writable-path inventory standing in for the read-only rootfs). The old `&& echo` checks that could never fail are real assertions now. - images.sh drives buildkitd with a pinned buildx (sha256-checked) via bake; PRs build verify targets with agent-runner FROM the in-run toolbox (target: context); main verifies, then pushes. Fails loudly when the builder secrets are absent or buildkitd is unreachable. - infra/gitea/buildkit-client-secret.sh copies the client cert into Actions secrets. Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
jakman85andClaude Opus 5.5 committed
1 parent
65a7769f55
commit
310deb0f7d
28 files changed
+1490
-608
No files matched your search
@@ -50,7 +50,10 @@
|
||||
# default is deliberately EMPTY so a build that forgets it fails loudly instead of
|
||||
# resolving some other image named `agent-base`.
|
||||
ARG AGENT_BASE_IMAGE=
|
||||
FROM ${AGENT_BASE_IMAGE}
|
||||
# Stage `agent-runner` is the image that ships; stage `verify` (end of file) is a TEST stage built
|
||||
# FROM it that only runs assertions and is never pushed. build-image.sh and the CI pipeline
|
||||
# build `--target verify` to prove the image and `--target agent-runner` for the image itself.
|
||||
FROM ${AGENT_BASE_IMAGE} AS agent-runner
|
||||
|
||||
# Re-declared AFTER the FROM: an ARG from before the first FROM is not in scope in the
|
||||
# build stage, so the provenance layer below would otherwise record an empty base.
|
||||
@@ -208,3 +211,80 @@ WORKDIR /workspace
|
||||
# paths above; an ENTRYPOINT here would either be ignored or prepend something the policy
|
||||
# cannot see. `bash` is the interactive fallback for a human debugging the image locally.
|
||||
CMD ["/bin/bash"]
|
||||
|
||||
# =============================================================================
|
||||
# verify — a TEST stage, never shipped. Every assertion infra/agent/build-image.sh used to make
|
||||
# with `run --user 65532 --read-only --tmpfs /workspace --tmpfs /tmp --network none` now runs
|
||||
# here, at build time, because CI builds on rootless BuildKit where no container runtime exists.
|
||||
#
|
||||
# WHAT A BUILD STEP CAN AND CANNOT REPRODUCE, stated so nobody over-reads a green verify:
|
||||
# * uid 65532 ............ exact: USER is inherited from the agent-runner stage.
|
||||
# * --network none ....... exact: RUN --network=none, and the first check proves it.
|
||||
# * --read-only rootfs ... NOT reproducible: a RUN step always has a writable layer. It is
|
||||
# APPROXIMATED by permission: as uid 65532, every path the process can
|
||||
# write is inventoried and must lie under /workspace, /tmp or /var/tmp
|
||||
# (the pod mounts emptyDirs on the first two; /var/tmp is read-only
|
||||
# there, and TMPDIR points into /workspace so nothing should use it).
|
||||
# The pod's readOnlyRootFilesystem is enforced by admission
|
||||
# (platform/kyverno/admission/pm-agent-job-shape.yaml), not by this.
|
||||
# * --tmpfs /workspace ... approximated by the image's own /workspace (owned 65532), which is
|
||||
# what the pod's emptyDir replaces.
|
||||
# The probe script is COPYed into THIS stage only, so it never ships in the image.
|
||||
# =============================================================================
|
||||
FROM agent-runner AS verify
|
||||
COPY probe-validation.sh /opt/verify/probe-validation.sh
|
||||
RUN --network=none /bin/bash -euo pipefail <<'VERIFY'
|
||||
echo "--- no network (the build-time stand-in for run --network none) ---"
|
||||
if getent hosts registry.npmjs.org >/dev/null 2>&1 || curl -sS --max-time 3 -o /dev/null https://1.1.1.1 2>/dev/null; then
|
||||
echo "UNEXPECTED: network reachable in the verify stage"; exit 1
|
||||
fi
|
||||
echo " confirmed: no network"
|
||||
echo "--- id ---"; id
|
||||
echo "--- HOME ---"; echo "HOME=${HOME} CLAUDE_CONFIG_DIR=${CLAUDE_CONFIG_DIR}"
|
||||
echo "--- baked versions ---"; cat /etc/agent-runner-versions
|
||||
echo "--- the gate toolchain the worker needs (CLAUDE.md §3) ---"
|
||||
for t in git python3 bash yamllint check-jsonschema kyverno promtool chainsaw flux sops age kubectl jq diff; do
|
||||
if command -v "$t" >/dev/null 2>&1; then printf " ok %s\n" "$t";
|
||||
else printf " MISSING %s\n" "$t"; missing=1; fi
|
||||
done
|
||||
[ -z "${missing:-}" ] || { echo "the gate cannot run in this image"; exit 1; }
|
||||
echo "--- python can import the renderer dependency ---"
|
||||
python3 -c "import yaml; print('PyYAML', yaml.__version__)"
|
||||
echo "--- claude ---"; claude --version
|
||||
echo "--- the two entrypoints refuse arguments ---"
|
||||
# Each must REFUSE. (The old docker-run version wrote `cmd | grep -q ... && echo`, which under
|
||||
# `set -e` + pipefail could never fail the script; these are real assertions.)
|
||||
for e in pm-worker pm-dispatch; do
|
||||
out="$(/usr/local/bin/$e --anything 2>&1 || true)"
|
||||
grep -q "takes no arguments" <<<"$out" || { echo "UNEXPECTED: $e accepted an argument: $out"; exit 1; }
|
||||
echo " $e: rejected"
|
||||
done
|
||||
echo "--- the dispatcher selftest (branch vocabulary, result envelopes, Job template, persona) ---"
|
||||
PM_SELFTEST=1 /usr/local/bin/pm-dispatch
|
||||
echo "--- the entrypoints are root-owned and NOT writable by the runtime uid ---"
|
||||
for f in /usr/local/bin/pm-worker /usr/local/bin/pm-dispatch /etc/pm-agent/worker-job-template.yaml; do
|
||||
stat -c " %n %U:%G %a" "$f"
|
||||
if [ -w "$f" ]; then echo "UNEXPECTED: uid $(id -u) can write $f"; exit 1; fi
|
||||
done
|
||||
echo " confirmed: not writable by uid $(id -u)"
|
||||
echo "--- the root filesystem is not writable by the runtime uid (expected: a failure) ---"
|
||||
if touch /should-fail 2>/dev/null; then echo "UNEXPECTED: / is writable by uid $(id -u)"; exit 1; fi
|
||||
echo " confirmed: / is not writable"
|
||||
echo "--- everything uid $(id -u) CAN write lies under /workspace, /tmp or /var/tmp ---"
|
||||
stray="$(find / -xdev \( -path /proc -o -path /sys -o -path /dev \) -prune -o -writable ! -type l -print 2>/dev/null \
|
||||
| grep -vE '^/(workspace|tmp|var/tmp)(/|$)' || true)"
|
||||
if [ -n "${stray}" ]; then echo "UNEXPECTED: writable outside the allowed paths:"; printf ' %s\n' ${stray} | head -20; exit 1; fi
|
||||
echo " confirmed: no writable path outside /workspace, /tmp, /var/tmp"
|
||||
echo "--- the two writable paths really are writable ---"
|
||||
touch "${HOME}/.probe" /tmp/.probe || { echo "UNEXPECTED: ${HOME} or /tmp not writable"; exit 1; }
|
||||
echo " confirmed: ${HOME} and /tmp are writable"
|
||||
echo "--- uid is non-zero ---"
|
||||
[ "$(id -u)" -ne 0 ] || { echo "UNEXPECTED: running as root"; exit 1; }
|
||||
echo " confirmed: uid $(id -u), not root"
|
||||
echo "--- no Anthropic API key is baked into the image (it would outrank the subscription token) ---"
|
||||
[ -z "${ANTHROPIC_API_KEY:-}${ANTHROPIC_AUTH_TOKEN:-}" ] || { echo "UNEXPECTED: an Anthropic key is baked in"; exit 1; }
|
||||
echo " confirmed: neither is set"
|
||||
echo "--- pm-worker's input validation, with the interpreter and script that run in the cluster ---"
|
||||
PM_WORKER_PATH=/usr/local/bin/pm-worker /bin/bash /opt/verify/probe-validation.sh
|
||||
echo "AGENT-RUNNER VERIFIED"
|
||||
VERIFY
|
||||
Reference in new issue
Block a user