commit 5a9fc95a99cd7b21fe2de9707e4a3286a358635f
author Aled Sage <aled.sage@gmail.com> Mon Sep 24 13:32:07 2018 +0100
committer Aled Sage <aled.sage@gmail.com> Mon Sep 24 14:03:56 2018 +0100
tree eea53ee9ee48289d3d219aeb3913baf5df575a39
parent a94f7d84ebcd984ec7c44d62add2f00d5e663717

Jenkins docker: use non-root user

Jenkinsfile

diff --git a/Jenkinsfile b/Jenkinsfile
index 42af8b3..76a41e3 100644
--- a/Jenkinsfile
+++ b/Jenkinsfile
@@ -36,16 +36,16 @@
             }
 
             stage('Run tests') {
-                environmentDockerImage.inside('-i --name brooklyn-${DOCKER_TAG} -v ${WORKSPACE}/.m2:/root/.m2 -v ${WORKSPACE}:/usr/build -w /usr/build') {
-                    sh 'mvn clean install'
+                environmentDockerImage.inside('-i --name brooklyn-${DOCKER_TAG} -u 910:910 -v ${WORKSPACE}/.m2:/var/maven/.m2 -v ${WORKSPACE}:/usr/build -w /usr/build -e MAVEN_CONFIG=/var/maven/.m2') {
+                    sh 'mvn clean install -Duser.name=$(id -un 910)'
                 }
             }
 
             // Conditional stage to deploy artifacts, when not building a PR
             if (env.CHANGE_ID == null) {
                 stage('Deploy artifacts') {
-                    environmentDockerImage.inside('-i --name brooklyn-${DOCKER_TAG} -v ${WORKSPACE}/.m2:/root/.m2 -v ${WORKSPACE}:/usr/build -w /usr/build') {
-                        sh 'mvn deploy -DskipTests'
+                    environmentDockerImage.inside('-i --name brooklyn-${DOCKER_TAG} -u 910:910 -v ${WORKSPACE}/.m2:/var/maven/.m2 -v ${WORKSPACE}:/usr/build -w /usr/build -e MAVEN_CONFIG=/var/maven/.m2') {
+                        sh 'mvn deploy -DskipTests -Duser.name=$(id -un 910)'
                     }
                 }
 
@@ -79,4 +79,4 @@
             ])
         }
     }
-}
\ No newline at end of file
+}

README.md

diff --git a/README.md b/README.md
index c046066..147295e 100644
--- a/README.md
+++ b/README.md
@@ -23,7 +23,10 @@
 Then run the build:
 
 ```bash
-docker run -i --rm --name brooklyn-library -v ${HOME}/.m2:/root/.m2 -v ${PWD}:/usr/build -w /usr/build brooklyn:library mvn clean install
+docker run -i --rm --name brooklyn-library -u $(id -u $(whoami)):$(id -g $(whoami)) \
+    -e MAVEN_CONFIG=/var/maven/.m2 \
+    -v ${HOME}/.m2:/var/maven/.m2 -v ${PWD}:/usr/build -w /usr/build \
+    brooklyn:library mvn clean install -Duser.home=/var/maven -Duser.name=$(whoami)
 ```
 
 ### Using maven
@@ -32,4 +35,4 @@
 
 ```bash
 mvn clean install
-```
\ No newline at end of file
+```