Wsrtjtyk

I am using edited docker-maven image to compile java maven projects using Jenkins pipeline script. I mount jenkins workspace as volume for the docker. One of the first groovy scripts that run inside the pipeline cleans up the whole workspace.

However the target folder with all containings (.war file, surefire reports etc.) is created as root:root permissions. All the files are also owned by root and therefore the pipeline is failing within next run because it can not clean up workspace (Permission denied).

I investigated this issue a lot and I found two workarounds:

• From official maven documentation - Use settings.xml and specify: filePermissions to 777 and directoryPermissions to 777. I think it is dirty fix and should not be applied...


• Add Jenkins to sudoers and invoke a script with sudo rm -rf + on the workspace - but since we use many slave machines I would have to do this on many machines and I belive that there is a better way.

This is how my Dockerfile for maven image looks like:

FROM <our-internal-image>



RUN export http_proxy=$HTTP_PROXY && 

    export https_proxy=$HTTPS_PROXY && 

    zypper -n in tar which java-1_8_0-openjdk java-1_8_0-openjdk-devel && 

    zypper clean && 

    SUSEConnect --cleanup



RUN mkdir -p /usr/share/maven /usr/share/maven/ref && 

    curl -fsSL -o /tmp/apache-maven.tar.gz https://apache.osuosl.org/maven/maven-3/3.6.0/binaries/apache-maven-3.6.0-bin.tar.gz && 

    tar -xzf /tmp/apache-maven.tar.gz -C /usr/share/maven --strip-components=1 && 

    rm -f /tmp/apache-maven.tar.gz && 

    ln -s /usr/share/maven/bin/mvn /usr/bin/mvn



ENV JAVA_HOME /usr/lib64/jvm/java-1.8.0-openjdk

ENV MAVEN_HOME /usr/share/maven

ENV MAVEN_CONFIG "/root/.m2"



ENTRYPOINT ["/usr/bin/mvn"]

And this is how I invoke the compilation of our maven based module (docker-maven is name for the image created based on the Dockerfile):

def _compileMavenModule = {

    stage('Build - compile maven module') {

        sh "docker run " +

                "--name maven-module-${BUILD_ID} " +

                "--rm " +

                "-v ${WORKSPACE}:/build " +

                "-e http_proxy="${http_proxy}" " +

                "-e https_proxy="${https_proxy}" " +

                "-e HTTP_PROXY="${http_proxy}" " +

                "-e HTTPS_PROXY="${https_proxy}" " +

                "-e MAVEN_OPTS="-Dhttp.proxyHost=<HTTP_PROXY> -Dhttp.proxyPort=<HTTP_PROXY_PORT>-Dhttps.proxyHost=HTTP_PROXY> -Dhttps.proxyPort=<HTTP_PROXY_PORT>" " +

                "docker-maven clean package -f /build/path-to-maven-repository/pom.xml"

    }

}

Is there a way to run maven inside the docker image as jenkins? Or to make the files created by this docker image be jenkins:jenkins? All the other images that run ANT targets create output with jenkins:jenkins privileges. Only the maven does not... Maybe I am not aware of some setting or something. Help me please!

Pass --user option in docker run:

sh "docker run " +

            "--name maven-module-${BUILD_ID} " +

            "--user ${env.BUILD_USER_ID}:${env.BUILD_USER_ID}" +

            "--rm " +

            "-v ${WORKSPACE}:/build " +

            "-e http_proxy="${http_proxy}" " +

            "-e https_proxy="${https_proxy}" " +

            "-e HTTP_PROXY="${http_proxy}" " +

            "-e HTTPS_PROXY="${https_proxy}" " +

            "-e MAVEN_OPTS="-Dhttp.proxyHost=<HTTP_PROXY> -Dhttp.proxyPort=<HTTP_PROXY_PORT>-Dhttps.proxyHost=HTTP_PROXY> -Dhttps.proxyPort=<HTTP_PROXY_PORT>" " +

            "docker-maven clean package -f /build/path-to-maven-repository/pom.xml"

}

This will pass your current user as user and group inside Docker container.

EDIT: If those variables are empty, you can try to get the values using bash:

user = sh(returnStdout: true, script: 'id -u').trim()

group = sh(returnStdout: true, script: 'id -g').trim()

sh "docker run " +

            "--name maven-module-${BUILD_ID} " +

            "--user $user:$group" +

            …