Docker部署Jenkins流水线构建失败：权限拒绝问题求助

错误日志 #

sh: /var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-log.txt: Permission denied
sh: /var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-result.txt.tmp: Permission denied
touch: cannot touch '/var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-log.txt': Permission denied
mv: cannot stat '/var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-result.txt.tmp': No such file or directory
touch: cannot touch '/var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-log.txt': Permission denied
touch: cannot touch '/var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-log.txt': Permission denied
touch: cannot touch '/var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-log.txt': Permission denied
touch: cannot touch '/var/jenkins_home/workspace/fake_message_main@2@tmp/durable-ac93e82e/jenkins-log.txt': Permission denied

Jenkins流水线配置（Jenkinsfile） #

pipeline {
    agent any 
    
    stages {
        stage('Check Docker') {
            steps {
                echo 'checking if docker exists...'
                sh 'docker --version'
            }
        }
        stage ('Test'){
            parallel {
                stage ('Test Rocky 8.1') {
                    agent {
                        docker {
                            image 'localhost:5000/centos7:latest'
                            args '-u jenkins:jenkins'
                        }
                    }
                    steps {
                        script {
                            echo env.WORKSPACE
                            echo 'Building Rpm...'
                            sh 'python3 --version'
                        }
                    }
                }
            }
        }
        stage ('Build'){
            parallel {
                stage ('Test Rocky 8.1') {
                    agent {
                        docker {
                            image 'localhost:5000/centos7:latest'
                            args '-u root:root'
                        }
                    }
                    steps {
                        echo 'Building Rpm...'
                        sh 'python3 --version'
                    }
                    post {
                        always {
                            cleanWs()
                        }
                    }
                }
            }
        }
        stage("deploy") {
            steps {
                echo 'Hello World'
                echo "deploying the aplication... wooooow!!!"
            }
        }
    }
}

Jenkins容器启动命令 #

docker run -u 0 \
  --privileged --rm \
  --name jenkins -d \
  -p 8080:8080 -p 50000:50000 \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v $(which docker):/usr/bin/docker \
  -v jenkins_home:/var/jenkins_home \
  -e JAVA_OPTS="-Dorg.jenkinsci.plugins.durabletask.BourneShellScript.LAUNCH_DIAGNOSTICS=true" \
  jenkins/jenkins:latest 

自定义CentOS7镜像构建脚本（Dockerfile） #

FROM centos:centos7
ADD files/tmp /tmp
RUN rpm --import /tmp/*.pub
RUN yum clean all
RUN yum -y install openssh-clients
RUN yum -y install \
    epel-release
RUN yum makecache && yum -y install \
    python27 \
    python-pip \
    python-requests \
    python2-mock \
    python34-devel \
    python34-mock \
    rpmdevtools  \
    rpmlint \
    rpm-build \
    python-devel \
    python2-devel \
    python2-setuptools \
    python34-setuptools \
    python36-devel \
    python36-setuptools \
    which \
    perl-devel \
    perl-ExtUtils-MakeMaker
RUN yum -y install \
    gcc \
    zlib zlib-devel lzma xz-devel \
    openssl-devel ncurses-devel bzip2-devel \
    readline-devel libffi-devel sqlite-devel
RUN yum -y group install "Development Tools"

RUN groupadd -g 1000 jenkins && \
    useradd -m jenkins -u 1000 -g 1000

ADD files/etc/rpm-repo.conf /root/scripts/rpm-repo.conf
ADD files/scripts/scp-upload.sh /root/scripts/scp-upload.sh
ADD files/scripts/pyenv.sh /home/jenkins/
ADD files/etc/argo.repo /etc/yum.repos.d
RUN pip install httmock coverage=='4.5.4' unittest2 discover
RUN pip install -U "pip==20.*" "setuptools<45.0.0" && pip install pipenv
RUN pip3 install -U pip setuptools
RUN pip3 install mock httmock tox tox-pyenv requests pytest coverage unittest-xml-reporting aiofiles lxml unidecode
RUN yum install -y python3-aiohttp python3-bonsai python3-avro
COPY files/build-rpm.sh /home/jenkins/build-rpm.sh
USER jenkins
WORKDIR /home/jenkins
RUN curl https://pyenv.run | bash
RUN mv $HOME/.pyenv $HOME/pyenv
RUN source $HOME/pyenv.sh && pyenv install --list | grep ' 3.7' | tail -n1 | xargs pyenv install
RUN source $HOME/pyenv.sh && pyenv install --list | grep ' 3.8' | tail -n1 | xargs pyenv install
RUN source $HOME/pyenv.sh && pyenv install --list | grep ' 3.9' | tail -n1 | xargs pyenv install
RUN source $HOME/pyenv.sh && pyenv install --list | grep 'mambaforge' | tail -n1 | xargs pyenv install
RUN source $HOME/pyenv.sh && pyenv local $(pyenv versions | grep 'mambaforge' | head -n1)
RUN source $HOME/pyenv.sh && mamba create -y -n ams-py310 python=3.10
RUN source $HOME/pyenv.sh && pyenv local system
RUN rm $HOME/.python-version
USER root
WORKDIR /root
RUN su - jenkins rpmdev-setuptree

已尝试的解决方案 #

• 将args '-u jenkins:jenkins'替换为args '-u root:root'，流水线可正常运行，但不希望以root身份执行构建
• 尝试提前修改工作目录权限，但未解决问题

需要找到无需以root身份运行即可解决该权限问题的方法。

内容的提问来源于stack exchange，提问作者dean89