Merge pull request #756 from buildkite/isolate-docker-config

always use a fresh docker config for each step
buildkite · Oct 26, 2020 · 061e549 · 061e549
2 parents 83569d4 + 528cf6a
commit 061e549
Show file tree

Hide file tree

Showing 4 changed files with 20 additions and 0 deletions.
diff --git a/packer/linux/conf/buildkite-agent/hooks/environment b/packer/linux/conf/buildkite-agent/hooks/environment
@@ -4,6 +4,11 @@ set -eu -o pipefail
 # shellcheck source=/dev/null
 source ~/cfn-env
 
+# a clean docker config for each job, for improved isolation
+BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY=$(mktemp -d)
+export BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY
+export DOCKER_CONFIG="$BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY"
+
 echo "~~~ :llama: Setting up elastic stack environment ($BUILDKITE_STACK_VERSION)"
 cat ~/cfn-env
 

diff --git a/packer/linux/conf/buildkite-agent/hooks/pre-exit b/packer/linux/conf/buildkite-agent/hooks/pre-exit
@@ -2,6 +2,11 @@
 
 set -eu -o pipefail
 
+# clean up our temporary docker config
+if [[ -n "${BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY:-}" && -d "$BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY" ]]; then
+  rm -rf "$BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY"
+fi
+
 if [[ -n "${BUILDKITE_SECRETS_BUCKET:-}" &&  "${SECRETS_PLUGIN_ENABLED:-}" == "1" ]] ; then
   export BUILDKITE_PLUGIN_S3_SECRETS_BUCKET="$BUILDKITE_SECRETS_BUCKET"
 

diff --git a/packer/windows/conf/buildkite-agent/hooks/environment b/packer/windows/conf/buildkite-agent/hooks/environment
@@ -4,6 +4,11 @@ set -eu -o pipefail
 # shellcheck source=/dev/null
 source ~/cfn-env
 
+# a clean docker config for each job, for improved isolation
+BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY=$(mktemp -d)
+export BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY
+export DOCKER_CONFIG="$BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY"
+
 echo "~~~ :llama: Setting up elastic stack environment ($BUILDKITE_STACK_VERSION)"
 cat ~/cfn-env
 

diff --git a/packer/windows/conf/buildkite-agent/hooks/pre-exit b/packer/windows/conf/buildkite-agent/hooks/pre-exit
@@ -2,6 +2,11 @@
 
 set -eu -o pipefail
 
+# clean up our temporary docker config
+if [[ -n "${BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY:-}" && -d "$BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY" ]]; then
+  rm -rf "$BUILDKITE_DOCKER_CONFIG_TEMP_DIRECTORY"
+fi
+
 if [[ -n "${BUILDKITE_SECRETS_BUCKET:-}" &&  "${SECRETS_PLUGIN_ENABLED:-}" == "1" ]] ; then
   export BUILDKITE_PLUGIN_S3_SECRETS_BUCKET="$BUILDKITE_SECRETS_BUCKET"