Add Windows image packaging scripts#27
Conversation
|
I built the image and pushed it to a local registry (stefanscherer/registry-windows). After that I configured jenkins with SSH key injection. Anything else I need to know regarding configuration in jenkins? Because of short test results in |
|
While testing it locally I didn't see that issue. Can you post a full log? Do you have any env variables set in Jenkins global configuration? |
|
Here is the current log. Its jenkins LTS with the current docker plugin 1.1.7 and SSH slaves plugin 1.30.1 running as master itself in a docker container. The master requests to for the win-ssh-agent (based on your files) image via docker daemon on a windows 10 pc. The windows 10 pc contains docker desktop (CE) edition with windows containers. |
|
What might be interesting too is, that starting the container with docker logs shows |
|
Jenkins docker plugins don't support Windows containers for agents. You'd need to spin up the agent container manually until that changes. Also, when running manually, if you use -it it won't exit. It's something I have been trying to figure out since sshd is running as a service. |
I feared something like that. Hmm ... have to think about. Thanks Alex for your help. |
|
@slide Any good hint/example how to do it manually without docker-plugin? |
|
I just ran the container manually on my server. That is not ideal obviously. I don't have a better solution at this point. |
| New-Item -Type Directory -Path "C:\ProgramData\Jenkins" | Out-Null | ||
|
|
||
| # setup SSH server | ||
| RUN [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 ; ` |
There was a problem hiding this comment.
Perhaps enabling Tls12 could be upstreamed?
Here is a PowerShell script version of it, could be converted to Docker run :)
#requires -runasadministrator
# set strong cryptography on 64 bit .Net Framework
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Wow6432Node\Microsoft\.NetFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -Type DWord
# set strong cryptography on 32 bit .Net Framework
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SchUseStrongCrypto' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NETFramework\v2.0.50727' -Name 'SystemDefaultTlsVersions' -Value '1' -Type DWord
Set-ItemProperty -Path 'HKLM:\SOFTWARE\Microsoft\.NetFramework\v4.0.30319' -Name 'SystemDefaultTlsVersions' -Value '1' -Type DWord
|
@BlueAndi I'll see if I can get around to upstreaming our fix to docker plugin that adds support for Windows sadly it kinda depends on Git client plugin v3 which is still in beta. This is needed for Windows OpenSSH |
|
jenkinsci/git-client-plugin#371 has been released in git client plugin 2.8.1 |
ndeloof
left a comment
ndeloof
left a comment
There was a problem hiding this comment.
I have 0 experience with Windows cointainers so can't offer a significant advise on this PR.
I will give it a try in the next days. |
|
@Casz Did you upstream the fix to the docker plugin with windows support? |
|
There is PR open but I haven't been able to get around to it: jenkinsci/docker-workflow-plugin#184 You should be able to test it with this: https://ci.jenkins.io/job/Plugins/job/docker-workflow-plugin/job/PR-184/1/artifact/org/jenkins-ci/plugins/docker-workflow/1.20-rc400.6982db7f7860/docker-workflow-1.20-rc400.6982db7f7860.hpi |
|
@Casz As a first feedback, it looks good and I got it running. This means the container is remotely created, started and stopped again. I will do some more tests. The windows container base on this PR, but not with the latest modifications. |
|
@slide After the container is started, I try to connect via I checked the file access: Any hint? |
|
@BlueAndi Not sure why you would use localhost unless you are passing port 22 through? |
|
I am on the same machine, where the docker container is running. Its just for the test. I get the same problem, connecting from a different machine. The sshd in the container aborts with the bad ownership log. Today I took a look to the openssh documentation and there they said only SYSTEM, Administrators and the owner shall have access. Not sure about the additional SID, see above. BTW port 22 is mapped. Tried a mapping to 2222 too, just to be sure, but same behaviour. |
|
The SID you see should be the jenkins user account SID. I'll try and look at this later today. |
|
This is the patch I did for git client plugin for it to work with Openssh: jenkinsci/git-client-plugin#447 |
|
@BlueAndi I am unable to reproduce your issue. I am running the container as follows: Then I am ssh'ing with the following: This is working for me just fine. |
|
Client: Docker Engine - Community Server: Docker Engine - Community |
|
I'll see if I can find a Windows 10 system that I can put docker on. |
|
I tried running on a Windows 10 system. I had to use a different tag to build the image, then I was able to SSH into the system using the key just fine. No error about bad ownership on the key. Can you provide all the steps you are using to try and get this working? |
|
The steps with your image:
Which tag did you have to use? |
|
My Windows 10 version required me to use |
|
We use a 1903 ... funny is, that the 1809 runs on a 1903, but only with the latest updates from Microsoft. openJDK provides right now no image with 1903, so I have to build first a openJDK image with 1903. But that could be the key. Regarding NAT, it was no problem. We didn't have to change something. But lets try with 1903 and I will send feedback about the result. |
|
Yeah, I removed the NAT portion of my comment because I realized my network was setup weird on that system. Once I tried with a normal network setup I was able to use localhost no problem. |
|
In the meanwhile I built a openJDK image with Lets stop here now. I will continue the investigation next week. Anyway again thank you very much!!!! Without your help and suggestions it would be much harder. |
|
@ndeloof Are you planning on continuing to maintain this repo? If not, would it be ok if I added myself to the committer list via the ircbot? |
|
FYI if (!IsWellKnownSid(owner_sid, WinBuiltinAdministratorsSid) &&
!IsWellKnownSid(owner_sid, WinLocalSystemSid) &&
!EqualSid(owner_sid, user_sid)) {
debug3("Bad owner on %S", path_utf16);
ret = -1;
goto cleanup;
} |
|
I would assume its failing on the following: |
|
It's working now, but I am not sure whether I understand it.
Do you have a local "jenkins" user on your host system?
|
|
No, I do not have a local jenkins user on the host system. |
|
If I use |
|
We can definitely change it to another location inside the image. Maybe this is a difference between Docker CE and Docker EE? |
|
According to this, the VOLUME stuff is no longer an issue on Windows Server 2019. https://blog.sixeyed.com/what-you-can-do-with-docker-in-windows-server-2019-that-you-couldnt-do-in-windows-server-2016/. I'm not sure if Windows 10 would be considered to be more like Windows Server 2016 or Windows Server 2019, but that could be the root of the issues you are seeing. |
|
But you tested it on windows 10 as well and without an existing jenkins user. Did you use there docker EE? |
|
No, I did not use EE. |
|
I pushed a version of the image based on this PR to |
|
Same problem. Can you please create additional the user "jenkins" in the host system, before you build the image? Ensure that the user directory exists. See again the Hyper-V related SID: |
|
That is a problem because there won't necessarily be a enkins user on the systems when this is built in automated builds. |
|
That is true. BTW the |
|
I believe that line is creating two volume mount points. |
|
Is there any additional feedback on this, or can it get merged? I don't have access to merge in this repo. |
|
Nothing from my side. |
oleg-nenashev
changed the title
6 participants
This adds Windows image with SSH support. I can add tests if desired.