From a298d737ce42b0589f5ae56d80379efdcc6c2b43 Mon Sep 17 00:00:00 2001 From: Wei Liu <51599940+liuwei08@users.noreply.github.com> Date: Thu, 2 Jul 2026 10:40:04 +0800 Subject: [PATCH 1/4] =?UTF-8?q?Revert=20"Revert=20"feat:=20support=20mount?= =?UTF-8?q?ing=20docker=20config=20secret=20for=20job=20container=E2=80=A6?= =?UTF-8?q?"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit f9d79fffaeb3cbd46de8c2225e310fb075adf553. --- deploy/infrabox/templates/function_crd.yaml | 12 ++++++++++++ deploy/infrabox/values.yaml | 5 +++++ 2 files changed, 17 insertions(+) diff --git a/deploy/infrabox/templates/function_crd.yaml b/deploy/infrabox/templates/function_crd.yaml index 7e2821b99..bf2a09cb7 100644 --- a/deploy/infrabox/templates/function_crd.yaml +++ b/deploy/infrabox/templates/function_crd.yaml @@ -33,6 +33,12 @@ spec: mountPath: /etc/ssl/certs/saprootca.pem name: dockerd-config subPath: rootca.pem +{{ end }} +{{- if .Values.job.docker_config_secret }} + - + mountPath: /root/.docker/config.json + name: docker-config + subPath: config.json {{ end }} - name: data-dir @@ -50,6 +56,12 @@ spec: name: dockerd-config configMap: name: infrabox-dockerd-config +{{- if .Values.job.docker_config_secret }} + - + name: docker-config + secret: + secretName: {{ .Values.job.docker_config_secret }} +{{ end }} {{ if .Values.local_cache.enabled }} - name: local-cache diff --git a/deploy/infrabox/values.yaml b/deploy/infrabox/values.yaml index f6fe8f978..071366fb1 100644 --- a/deploy/infrabox/values.yaml +++ b/deploy/infrabox/values.yaml @@ -360,6 +360,11 @@ job: {} storage_driver: overlay + # Name of a K8s Secret (in infrabox-worker namespace) containing a config.json + # key with pre-authenticated docker credentials. Allows job containers to pull + # from private registries without explicit docker login. + # The secret can be managed via ExternalSecret synced from Vault. + docker_config_secret: "" #rootca_pem: |- # Using base64 encoded string to put the cert in one line From 7a0f4730deaa8a229a0c4f5d80e3552ad857a522 Mon Sep 17 00:00:00 2001 From: I515719 Date: Thu, 2 Jul 2026 10:47:08 +0800 Subject: [PATCH 2/4] fix: mount docker config secret as directory to avoid cross-device rename error --- deploy/infrabox/templates/function_crd.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/deploy/infrabox/templates/function_crd.yaml b/deploy/infrabox/templates/function_crd.yaml index bf2a09cb7..f1b5b9044 100644 --- a/deploy/infrabox/templates/function_crd.yaml +++ b/deploy/infrabox/templates/function_crd.yaml @@ -36,9 +36,8 @@ spec: {{ end }} {{- if .Values.job.docker_config_secret }} - - mountPath: /root/.docker/config.json + mountPath: /root/.docker name: docker-config - subPath: config.json {{ end }} - name: data-dir From 5420dc881e3d01ee67917fa3bbd86f2609c6c2c9 Mon Sep 17 00:00:00 2001 From: I515719 Date: Thu, 2 Jul 2026 11:08:58 +0800 Subject: [PATCH 3/4] fix: use emptyDir for /root/.docker to allow docker build and login Mount docker config secret to /tmp/docker-secret (read-only) and use emptyDir for /root/.docker (writable). Copy config.json in entrypoint.sh before docker daemon starts. This fixes two issues: - docker login rename failing across devices (subPath bind mount) - docker build mkdir /root/.docker/buildx: read-only file system --- deploy/infrabox/templates/function_crd.yaml | 8 +++++++- src/job/entrypoint.sh | 6 ++++++ 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/deploy/infrabox/templates/function_crd.yaml b/deploy/infrabox/templates/function_crd.yaml index f1b5b9044..355d5b050 100644 --- a/deploy/infrabox/templates/function_crd.yaml +++ b/deploy/infrabox/templates/function_crd.yaml @@ -36,9 +36,12 @@ spec: {{ end }} {{- if .Values.job.docker_config_secret }} - - mountPath: /root/.docker + mountPath: /tmp/docker-secret name: docker-config {{ end }} + - + name: docker-dir + mountPath: /root/.docker - name: data-dir mountPath: "/data" @@ -51,6 +54,9 @@ spec: - name: data-dir emptyDir: {} + - + name: docker-dir + emptyDir: {} - name: dockerd-config configMap: diff --git a/src/job/entrypoint.sh b/src/job/entrypoint.sh index 4116acb8a..f6835cd1a 100755 --- a/src/job/entrypoint.sh +++ b/src/job/entrypoint.sh @@ -4,6 +4,12 @@ mkdir -p /data/infrabox mkdir -p /data/tmp mkdir -p /data/repo mkdir -p ~/.ssh +mkdir -p /root/.docker + +if [ -f /tmp/docker-secret/config.json ]; then + cp /tmp/docker-secret/config.json /root/.docker/config.json + echo "Docker config copied from secret" +fi function startDocker() { From ef09113fb23cc2d5be269fdbabd84b9ba408225b Mon Sep 17 00:00:00 2001 From: I515719 Date: Thu, 2 Jul 2026 11:24:36 +0800 Subject: [PATCH 4/4] fix: make docker-dir emptyDir conditional on docker_config_secret --- deploy/infrabox/templates/function_crd.yaml | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/deploy/infrabox/templates/function_crd.yaml b/deploy/infrabox/templates/function_crd.yaml index 355d5b050..3c641f4b6 100644 --- a/deploy/infrabox/templates/function_crd.yaml +++ b/deploy/infrabox/templates/function_crd.yaml @@ -38,10 +38,10 @@ spec: - mountPath: /tmp/docker-secret name: docker-config -{{ end }} - name: docker-dir mountPath: /root/.docker +{{ end }} - name: data-dir mountPath: "/data" @@ -54,19 +54,19 @@ spec: - name: data-dir emptyDir: {} +{{- if .Values.job.docker_config_secret }} - name: docker-dir emptyDir: {} - - - name: dockerd-config - configMap: - name: infrabox-dockerd-config -{{- if .Values.job.docker_config_secret }} - name: docker-config secret: secretName: {{ .Values.job.docker_config_secret }} {{ end }} + - + name: dockerd-config + configMap: + name: infrabox-dockerd-config {{ if .Values.local_cache.enabled }} - name: local-cache