7

When using Jenkins slave running in container, what are alternatives or "safe" (in terms of security) implementations for Docker in Docker.

Architecture example:

  1. Jenkins master running as Docker container
  2. Jenkins slave running as Docker container
  3. Test task executed in Docker container

Some known alternatives:

Constraints clarification: the idea is to use Jenkins as an orchestrator and Docker for clean environment, the rest of architecture is a subject to change.

  • 2
    Thanks for the question, you have taught me about Docker-in-docker - for everyone else that is new to the topic then it would be worth reading Jérôme Petazzoni's description of advantages and disadvantages of. – Richard Slater Mar 26 '17 at 12:21
  • 1
    @RichardSlater Depends how workloads are defined (jobs/day, slaves/master, cpu,data/job) but the question is more general. All listed security, turtles, performance are legit candidates to be avoided, as well as the smell of "hackity hack" mentioned in "Jérôme Petazzoni's description of advantages and disadvantages of..." – rombob Mar 26 '17 at 14:03
  • 1
    Nope, it's still unclear if your architecture still has to rely on jenkins slaves within docker or not. Anyway, tricks for ruby/python/java with multiples versions on same hosts (or docker image FWIW) are well known, those for nodejs or Go are less "common" and less easy to set up. So I'm really unsure the way you're open with and those you don't. If the plan is to still have jenkins as orchestrator and Docker for clean environment there's place to answer, if the slaves have to be within a docker environment, everything will be an ugly hack you can't really trust tests results. – Tensibai Mar 27 '17 at 12:03
  • 1
    @Tensibai thank you for directing to clarification regarding the question, my point was to keep it more general to leave more room for creativity in answers, including things you mentioned. As for specific case, tricks are known and being used, the opportunity Docker gives is to have one way of implementation for all types of workloads, if possible, try focusing on making it stable and safe. – rombob Mar 27 '17 at 13:39
  • 1
    @Tensibai Thank you for feedback, clarification added to question. – rombob Mar 27 '17 at 17:12
5

To avoid relying on dind (out of building new images from a dockerfile which should be ok) I'd look around Jenkins's kubernetes plugin.

It obviously needs to bring to life a kubernetes cluster but allow to have a one time jenkins agent to run the test in a clean isolated environment, and then tear it off. The maintenance costs of the kubernetes cluster should not be greater than maintaining your Jenkins slaves.

The bonus point is that you can version you slaves with specific environment and don't have to tweak around for multiples version of ruby/java/python and let the task choose the proper "environment" by specifying the agent image to use and have a ready to test environment without any tweak pre-test.

I'd head toward kurbenetes as container scheduler because it is relatively lightweight to configure and maintain.

  • great approach, as an alternative mesos, swarm can be used, IMO swarm is a great candidate just because of relatively easy maintenance but can come with price of stability, too fresh technology – rombob Mar 28 '17 at 11:49
  • @rombob indeed, and mesos is quite heavy to maintain and probably overkill for this use case, I was wondering if stating this comparison/point would make sense in this answer. – Tensibai Mar 28 '17 at 11:50
  • maybe comparison would be great candidate for a new question – rombob Mar 28 '17 at 11:53
  • @rombob Usually they fade out of useful very quickly, specially with swarm under active development it would need an update nearly each week. So I would avoid it, even a blog post isn't really clear on the question after a whole list or pro/cons – Tensibai Mar 28 '17 at 11:58
  • When using the Jenkins Kubernetes plugin how do you dynamically choose a container to build in. I use the Jenkins Kubernetes plugin, but I still use dind because I want to build inside containers. I have a slave container with dind in it, but there has to be a better way. – David West Mar 12 '18 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.