Jenkins以jenkins用户启动流水线容器遇权限拒绝错误

问题背景 #

我制作了一个自定义Ubuntu Docker镜像，用于Jenkins构建项目，安装了所需软件包并配置了环境变量。对应的Dockerfile内容如下：

FROM ubuntu:focal

# Set environment 
ENV DEBIAN_FRONTEND=noninteractive
ENV PATH="${PATH}:/usr/local/bin" 
ENV DB_PATH="/var/database"
ENV DB_TYPE=SQLITE
ENV CONAN_USER_HOME=/var/conan

VOLUME ${DB_PATH}

RUN dpkg --add-architecture i386 \
    && apt-get update \
    && apt-get upgrade -y \
    && apt-get install -y \
        jq \
        lld \
        git \
        curl \
        libncurses5 \
        cmake \
        lsb-release \
        binutils \
        autoconf \
        pkg-config \
        subversion \
        ninja-build \
        python3 \
        python3-pip \
        python3-dev \
        python-dev-is-python3 \
        libudev-dev \
        libgtk2.0-dev \
        libgtk-3-dev \
        autotools-dev \
        openjdk-11-jdk \
        libwebkit2gtk-4.0-dev \
        gcc-multilib \
        g++-multilib \
        libdbus-1-dev:i386 \
        libgtk-3-dev:i386 \
    && apt-get autoclean \
    && rm -rf \
        /var/lib/apt/lists/* \
        /var/tmp/* \
        /tmp/*

RUN mkdir -p ${CONAN_USER_HOME} 

RUN pip install conan

报错信息 #

Jenkins流水线使用该镜像构建时，出现/var/conan目录权限拒绝错误，具体报错如下：

$ docker run -t -d -u 1000:1000 -w /home/jenkins/workspace/Conan -v /home/jenkins/workspace/Conan:/home/jenkins/workspace/Conan:rw,z -v /home/jenkins/workspace/Conan@tmp:/home/jenkins/workspace/Conan@tmp:rw,z -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** -e ******** git.example.com:8444/devops/docker-environments/ubuntu:focal cat
$ docker top 30052002a0f00f32e8f42901ba82a36867874ef29c17c5d20cbf564e5e20723c -eo pid,comm
[Pipeline] {
[Pipeline] stage
[Pipeline] { (export)
[Pipeline] sh
+ python scripts/export2local.py
Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/conans/util/files.py", line 193, in save
    os.makedirs(dir_path)
  File "/usr/lib/python3.8/os.py", line 223, in makedirs
    mkdir(name, mode)
PermissionError: [Errno 13] Permission denied: '/var/conan/.conan/hooks'

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/usr/local/lib/python3.8/dist-packages/conans/client/command.py", line 2216, in run
    method(args[0][1:])
  File "/usr/local/lib/python3.8/dist-packages/conans/client/command.py", line 1115, in export
    return self._conan.export(path=args.path,
  File "/usr/local/lib/python3.8/dist-packages/conans/client/conan_api.py", line 93, in wrapper
    return f(api, *args, **kwargs)
  File "/usr/local/lib/python3.8/dist-packages/conans/client/conan_api.py", line 879, in export
    cmd_export(self.app, conanfile_path, name, version, user, channel, keep_source,
  File "/usr/local/lib/python3.8/dist-packages/conans/client/cmd/export.py", line 112, in cmd_export
    hook_manager.execute("pre_export", conanfile=conanfile, conanfile_path=conanfile_path,
  File "/usr/local/lib/python3.8/dist-packages/conans/client/hook_manager.py", line 52, in execute
    save(self._attribute_checker_path, attribute_checker_hook)
  File "/usr/local/lib/python3.8/dist-packages/conans/util/files.py", line 196, in save
    raise OSError("The folder {} does not exist and could not be created ({})."
OSError: The folder /var/conan/.conan/hooks does not exist and could not be created (Permission denied).

问题核心 #

Jenkins以自定义UID/GID（1000:1000）的非root用户运行容器，而该用户在镜像构建时并不存在。创建的/var/conan目录默认属于root用户，导致Jenkins用户无法写入。即使取消CONAN_USER_HOME环境变量，Conan默认尝试写入的目录也因权限问题报错。

解决方案 #

方法1：直接开放目录全权限（CI环境常用） #

修改Dockerfile中创建${CONAN_USER_HOME}的指令，添加权限设置，让所有用户都能读写该目录：

RUN mkdir -p ${CONAN_USER_HOME} \
    && chmod -R 777 ${CONAN_USER_HOME}

方法2：更严谨的权限配置（可选） #

如果不想使用过于宽松的777权限，可以设置目录的组权限继承，并开放其他用户的读写权限：

RUN mkdir -p ${CONAN_USER_HOME} \
    && chmod -R ug+rwx,o+rw ${CONAN_USER_HOME} \
    && chmod g+s ${CONAN_USER_HOME}

g+s位可以确保后续在该目录下创建的文件自动继承目录的组权限，避免后续子目录出现权限问题。

额外注意 #

如果后续Conan默认路径仍出现权限问题，可以将CONAN_USER_HOME指向Jenkins的工作目录（该目录已通过挂载赋予读写权限），修改环境变量：

ENV CONAN_USER_HOME=/home/jenkins/workspace/Conan/.conan

不过这种方式依赖Jenkins工作目录的挂载配置，不如修改目录权限通用。

内容的提问来源于stack exchange，提问作者WilliamB