-
Notifications
You must be signed in to change notification settings - Fork 1.4k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Kaniko builds fail in Cloud Build without --additional-whitelist=/var/run
#1001
Comments
Getting this since latest debug image @sha256:d39c342cd6cbf7b85d2ca57dcd51f2a704d027b9b87cc6b7264e1def9949a633 |
also have this issue on latest debug image. Changed it to 0.15.0 |
I've hit this as well. Hoping for a fix soon. |
Same problem here |
I ran into this issue this morning. Appears to not have that /var/run issue with that version |
This is probably expected behavior. Couple of notes. I highly recommend that you set an explicit kaniko version in cloudbuild, the debug image is pushed on every commit to master. Use something like The So specifying I think this is expected behavior because this is probably one of the original reasons Unfortunately it is a breaking change for some builds, which was discussed in #973 cc @tejal29 |
@cvgw In that case, could you update the README for Cloud Build so it's more clear that we have to set that flag explicitly? Thanks |
@dinvlad, @keylowgee, @artichaulo, @atikhono, @wintersolutions,
We will also add a fix to retain the default behavior which is whitelisting |
Now it might fail with |
Yeah, I could never get this flag to actually work. I guess I'll revert to 0.15.0 while this gets resolved in some way. |
+1 |
hey folks, if you want to allow
|
Hey folks, our v0.17.0 release is out! Please use |
Could you add a note that we should use it in Cloud Build by default from now on? I.e. the default Cloud Build config suggested in README.md should be steps:
- name: gcr.io/kaniko-project/executor:latest
args: ["--dockerfile=<path to Dockerfile within the build context>",
"--context=dir://<path to build context>",
"--destination=<gcr.io/$PROJECT/$IMAGE:$TAG>",
"--whitelist-var-run=false"] Otherwise, it seems like this solution is not any different from where it started.. |
Alternatively, would it be possible to make Thanks |
@tejal29 I'm still getting the error after v0.17.0. Here's my config - name: "gcr.io/kaniko-project/executor:v0.17.0"
args:
[
"--dockerfile=Dockerfile",
"--destination=<url>,
"--whitelist-var-run=false",
] I get
Am I missing something? Using v15 without the whitelist flag just works. |
Yes, and we also got that error in Cloud Build! I suspect it's because CB has those images cached (because 0.17.0 was re-tagged). Maybe we could try the full sha256-based image tag.. Would it be possible to detect Cloud Build environment and set this option automatically instead, so that DevOps don't have to apply this fix retroactively? Thanks |
@dinvlad Tried doing sha256 tag
but still get the error. I took the image from |
Yep, same behavior. FWIW, i've just reverted to |
To re-iterate, what we'd like to be able to see (ideally) is that Kaniko auto-detects Cloud Build environment, and automatically whitelists Otherwise, the current behavior breaks all Cloud Build jobs that are using |
Just ran into this as well. Do you plan to roll out a fix soon, or should we roll back? |
/reopen |
This is broken when using the Kaniko debug image in GitLab CI. |
looks like #1021 is a dup of the bottom comments in here. broken for non debug image at 0.17.0 for everyone in cloudbuild i think |
hey folks, |
@dinvlad Previous versions of kaniko i.e.
If you are relying on the previous behavior your cloudbuild.yaml shd work as is. No need to change anythig. |
@tejal29 using GitLab CI/CD kubernetes runner, whether I set |
Yes, what I meant is that previous versions works without doing anything. As @higgs01 commented, version 0.17.0 fails whenever you set the flag to true,false or don't include it. |
@higgs01 and @ejose19 sorry for the breakage. Can you please give us some
|
@tejal29 currently I can't access the system I've encountered the problem with (corporate network). But I will send the debug logs tomorrow if it's still necessary then. |
@tejal29 here it is Cloudbuild: steps:
- name: "gcr.io/kaniko-project/executor:debug"
args:
["--dockerfile=Dockerfile", "--destination=<url>", "--verbosity=debug"] Dockerfile:
Logs:
|
From a GitLab CI build:
|
hey folks, PR in progress. #1025 Patch fix coming soon. |
@tejal29 can confirm now it works with both v0.17.1 and debug-v0.17.1 without needing to add any additional flag (like it was before). Thanks! |
Thanks for the quick fix @tejal29 ! Confirmed fixed for us too on cloudbuild with |
Thanks again @tejal29! I'm marking this as closed, anyone please feel free to re-open if you still have issues. |
Actual behavior
Kaniko builds fail in Cloud Build, in standard configuration.
Expected behavior
Kaniko builds work just fine, without the extra
--additional-whitelist=/var/run
flag.To Reproduce
Steps to reproduce the behavior:
--additional-whitelist=/var/run
to the build step, and it succeeds.Additional Information
Any Dockerfile (unverified).
Triage Notes for the Maintainers
Initially reported in #903 (comment)
--cache
flagThe text was updated successfully, but these errors were encountered: