JENKINS-74995 Add rootless support

[lnlrbr]

Resolve problem described in [JENKINS-74995]. Summary: It's not possible to use rootless mode with the actual implementation as the plugin retrieves the user (agent) UID:GID via the 'id' command and the returned value is not the one expected in a rootless environment (i.e. "0:0"), so builds fail. The provided change adds a test to look if we are in a rootless environment and returns the relevant value if needed.

Testing done

Tests were done with builds executed on two Linux nodes, one configured with Docker rootless mode and the other with Podman. The pipelines include a 'docker' and a 'dockerfile' agent section. There is some write access in the "build" stage to the mounted workspace. If builds are done with the not modified plugin, the run part is done under the current (jenkins) user '-u 1001:1001', and builds can failed for not enough permissions on mounted volumes, or can lead to files owned to root inside the workspaces. With builds done with the modified plugin, if a rootless environment is detected, the docker run part is done with the user parameter set to '-u 0:0'.

Submitter checklist

• [x] Make sure you are opening from a topic/feature/bugfix branch (right side) and not your main branch!
• [x] Ensure that the pull request title represents the desired changelog entry
• [x] Please describe what you did
• [x] Link to relevant issues in GitHub or Jira
• [x] Link to relevant pull requests, esp. upstream and downstream changes
• [x] Ensure you have provided tests - that demonstrates feature works or fixes the issue

[imoazeem]

+1

[imoazeem]

Does anyone have an update on whether this pull request will be reviewed and merged to add support for a rootless Docker setup ?

[concatime]

While replacing Docker with Podman in our CI, the Docker Workflow plugin would hang trying to start the first process inside the container. As you said, adding -u 0:0 solved this issue, but I had some issues with deleting the workspace due to UID/GID mismatch. The solution that I found is to use --userns keep-id instead of -u 0:0. The --userns flag also plays well with -u x:y that Docker Workflow plugin passes to Docker by default.

[reda-alaoui]

Exactly what we needed for docker rootless, thank you 🙏 Tested and validated :) Could someone please review this?

[sschuberth]

@jglick any chance to have a look?

[jglick]

@sschuberth no, I am not maintaining this plugin. In general, if it does not perfectly fit your needs the first time you try to use it, and every time thereafter, just do not use it. Run docker CLI commands from sh directly.

[lnlrbr]

@jglick: Asking thousands of users to update all their pipelines is simply not feasible. This plugin has become the de facto standard across many organizations. However, its current implementation grants excessive privileges, raising serious security concerns for the CI environment. For instance, as it stands, any user can mount the host’s /etc directory as a volume with full read/write access. The proposed change eliminates this vulnerability.