7

When using Jenkins slave running in container, what are alternatives or "safe" (in terms of security) implementations for Docker in Docker.

Architecture example:

  1. Jenkins master running as Docker container
  2. Jenkins slave running as Docker container
  3. Test task executed in Docker container

Some known alternatives:

Constraints clarification: the idea is to use Jenkins as an orchestrator and Docker for clean environment, the rest of architecture is a subject to change.

Improve this question
13
  • 2
    Thanks for the question, you have taught me about Docker-in-docker - for everyone else that is new to the topic then it would be worth reading Jérôme Petazzoni's description of advantages and disadvantages of.
    – Richard Slater
    Mar 26, 2017 at 12:21
  • 1
    @RichardSlater Depends how workloads are defined (jobs/day, slaves/master, cpu,data/job) but the question is more general. All listed security, turtles, performance are legit candidates to be avoided, as well as the smell of "hackity hack" mentioned in "Jérôme Petazzoni's description of advantages and disadvantages of..."
    – rombob
    Mar 26, 2017 at 14:03
  • 1
    Nope, it's still unclear if your architecture still has to rely on jenkins slaves within docker or not. Anyway, tricks for ruby/python/java with multiples versions on same hosts (or docker image FWIW) are well known, those for nodejs or Go are less "common" and less easy to set up. So I'm really unsure the way you're open with and those you don't. If the plan is to still have jenkins as orchestrator and Docker for clean environment there's place to answer, if the slaves have to be within a docker environment, everything will be an ugly hack you can't really trust tests results.
    – Tensibai
    Mar 27, 2017 at 12:03
  • 1
    @Tensibai thank you for directing to clarification regarding the question, my point was to keep it more general to leave more room for creativity in answers, including things you mentioned. As for specific case, tricks are known and being used, the opportunity Docker gives is to have one way of implementation for all types of workloads, if possible, try focusing on making it stable and safe.
    – rombob
    Mar 27, 2017 at 13:39
  • 1
    @Tensibai Thank you for feedback, clarification added to question.
    – rombob
    Mar 27, 2017 at 17:12

1 Answer 1

Reset to default
5

To avoid relying on dind (out of building new images from a dockerfile which should be ok) I'd look around Jenkins's kubernetes plugin.

It obviously needs to bring to life a kubernetes cluster but allow to have a one time jenkins agent to run the test in a clean isolated environment, and then tear it off. The maintenance costs of the kubernetes cluster should not be greater than maintaining your Jenkins slaves.

The bonus point is that you can version you slaves with specific environment and don't have to tweak around for multiples version of ruby/java/python and let the task choose the proper "environment" by specifying the agent image to use and have a ready to test environment without any tweak pre-test.

I'd head toward kurbenetes as container scheduler because it is relatively lightweight to configure and maintain.

Improve this answer
6
  • great approach, as an alternative mesos, swarm can be used, IMO swarm is a great candidate just because of relatively easy maintenance but can come with price of stability, too fresh technology
    – rombob
    Mar 28, 2017 at 11:49
  • @rombob indeed, and mesos is quite heavy to maintain and probably overkill for this use case, I was wondering if stating this comparison/point would make sense in this answer.
    – Tensibai
    Mar 28, 2017 at 11:50
  • maybe comparison would be great candidate for a new question
    – rombob
    Mar 28, 2017 at 11:53
  • @rombob Usually they fade out of useful very quickly, specially with swarm under active development it would need an update nearly each week. So I would avoid it, even a blog post isn't really clear on the question after a whole list or pro/cons
    – Tensibai
    Mar 28, 2017 at 11:58
  • When using the Jenkins Kubernetes plugin how do you dynamically choose a container to build in. I use the Jenkins Kubernetes plugin, but I still use dind because I want to build inside containers. I have a slave container with dind in it, but there has to be a better way.
    – David West
    Mar 12, 2018 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.