构建Jenkins Agent镜像时遇“Missing privilege separation directory: /run/sshd”错误

场景描述 #

我计划在ECS上部署Jenkins及Jenkins代理，团队原有Jenkins代理Dockerfile未包含Python环境。希望复用现有配置，仅添加Python环境以支持脚本运行，基于官方jenkins/agent:latest镜像修改了Dockerfile，运行镜像后出现启动错误。

修改后的Dockerfile #

# Use an official Jenkins agent image as a parent image
FROM jenkins/agent:latest

# Set the maintainer label
LABEL maintainer="xyz"

# Set environment variables
ENV DEBIAN_FRONTEND noninteractive

# Run all operations as root
USER root

# Update and install necessary packages
RUN apt-get update && apt-get install -y \
    apt-transport-https \
    ca-certificates \
    curl \
    gnupg2 \
    lxc \
    iptables \
    git \
    bison \
    build-essential \
    zlib1g-dev \
    libssl-dev \
    libxml2-dev \
    git-core \
    git-flow \
    python3 \
    python3-pip \
    npm \
    locales \
    unzip \
    awscli \
    openssh-server

# Configure SSH daemon with a dedicated user (more secure)
RUN mkdir -p /etc/sudoers.d \
&& echo "jenskins ALL=(ALL) NOPASSWD: /usr/local/bin/jenkins-agent" > /etc/sudoers.d/jenkins \
&& rm -f /etc/ssh/ssh_host_*_key /etc/ssh/ssh_host_*_key.pub \
&& ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N '' \
&& ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N '' \
&& ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N '' \
&& ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N '' \
&& sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config \
&& sed -i 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' /etc/pam.d/sshd

# Configure locale
RUN echo "en_US.UTF-8 UTF-8" > /etc/locale.gen && \
    locale-gen en_US.UTF-8 && \
    update-locale LANG=en_US.UTF-8

# Environment settings for locale
ENV LC_ALL=en_US.UTF-8
ENV LANG=en_US.UTF-8
ENV LANGUAGE=en_US.UTF-8

# Install Git LFS
RUN curl -s https://packagecloud.io/install/repositories/github/git-lfs/script.deb.sh | bash && \
    apt-get install -y git-lfs && \
    git lfs install

# Install ChefDK
RUN curl -L https://packages.chef.io/files/stable/chefdk/4.13.3/debian/10/chefdk_4.13.3-1_amd64.deb > /tmp/chefdk.deb && \
    dpkg -i /tmp/chefdk.deb && \
    rm /tmp/chefdk.deb

RUN curl -L https://releases.hashicorp.com/packer/1.7.8/packer_1.7.8_linux_amd64.zip > /tmp/packer.zip && \
    unzip /tmp/packer.zip -d /usr/local/bin && \
    rm /tmp/packer.zip

# Node.js and Azure CLI
RUN if [ ! -f /usr/bin/node ]; then ln -s /usr/bin/nodejs /usr/bin/node; fi && \
    npm install -g azure-cli

# Ensure the /etc/sudoers.d/ directory exists and configure sudoers for Jenkins user
RUN mkdir -p /etc/sudoers.d/ && \
    echo "jenkins ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/jenkins

# Install Docker using the convenient script

# Docker installation
RUN curl -sSL https://get.docker.com/ | sh

# Docker permissions
ADD wrapdocker /usr/local/bin/wrapdocker
# Add wrapdocker to the image
ADD wrapdocker /usr/local/bin/wrapdocker
RUN chmod +x /usr/local/bin/wrapdocker

# Add user Jenkins to the docker group
RUN usermod -a -G docker jenkins

# Add the Jenkins slave startup script and set it as the entrypoint
ADD jenkins-slave-startup.sh /jenkins-slave-startup.sh
RUN chmod +x /jenkins-slave-startup.sh

# Switch to Jenkins user
USER jenkins

# Set volume for Jenkins home
VOLUME /home/jenkins

# Expose SSH port
EXPOSE 22

USER jenkins
RUN ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519

# Reset user to root
USER root

EXPOSE 22

CMD ["/usr/sbin/sshd","-D"]

ENTRYPOINT ["/jenkins-slave-startup.sh"]

启动错误日志 #

docker run -d temp
4dd00647e8219af1093c961ab98ec34f990f502896deaf2e99bf609ea86e2db7
[root@ip-10-150-2-56 jenkins-slave]# docker logs 4d
+ /usr/sbin/sshd -D
+ '[' '!' -z /usr/sbin/sshd ']'
+ /usr/local/bin/wrapdocker
Missing privilege separation directory: /run/sshd

解决方案 #

错误原因是SSH守护进程需要的权限分离目录/run/sshd不存在，在Dockerfile中添加创建该目录的步骤即可解决：

在配置SSH daemon的RUN指令中，或者单独添加一条RUN指令创建目录：

# 创建SSH权限分离目录
RUN mkdir -p /run/sshd && chmod 0755 /run/sshd

建议将这条指令整合到SSH配置步骤中，修改后的配置段如下：

# Configure SSH daemon with a dedicated user (more secure)
RUN mkdir -p /etc/sudoers.d /run/sshd \
&& echo "jenkins ALL=(ALL) NOPASSWD: /usr/local/bin/jenkins-agent" > /etc/sudoers.d/jenkins \
&& rm -f /etc/ssh/ssh_host_*_key /etc/ssh/ssh_host_*_key.pub \
&& ssh-keygen -t rsa -f /etc/ssh/ssh_host_rsa_key -N '' \
&& ssh-keygen -t dsa -f /etc/ssh/ssh_host_dsa_key -N '' \
&& ssh-keygen -t ecdsa -f /etc/ssh/ssh_host_ecdsa_key -N '' \
&& ssh-keygen -t ed25519 -f /etc/ssh/ssh_host_ed25519_key -N '' \
&& sed -i 's/#PermitRootLogin prohibit-password/PermitRootLogin no/' /etc/ssh/sshd_config \
&& sed -i 's@session\s*required\s*pam_loginuid.so@session optional pam_loginuid.so@g' /etc/pam.d/sshd \
&& chmod 0755 /run/sshd

另外，Dockerfile中有重复添加wrapdocker的指令，可删除其中一条以避免冗余：

# Docker permissions
ADD wrapdocker /usr/local/bin/wrapdocker
RUN chmod +x /usr/local/bin/wrapdocker

重新构建镜像并运行，即可解决启动报错问题。

内容的提问来源于stack exchange，提问作者learner