My Docker Amazon-Linux2 build started failing on RUN yum -y update (only on pipelines)

[stnor]

FROM amazonlinux:latest

ENV TZ=Europe/Stockholm

##
## Timezone
##
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone


##
## Install Java, awslogs and other required stuff
##
RUN yum -y update
RUN yum -y install java-1.8.0-openjdk-headless shadow-utils.x86_64 tar unzip wget findutils awslogs

Updating : filesystem-3.2-25.amzn2.x86_64 73/162Error unpacking rpm package filesystem-3.2-25.amzn2.x86_64 error: unpacking of archive failed on file /proc: cpio: chown

Build works fine locally on macOS (anu four days ago in Bitbucket Pipelines...

[stnor · Accepted solution]

Apparently Atlassian rolled out a new "security feature" late september 2018:

Docker in Docker User Namespace Remapping

https://confluence.atlassian.com/bitbucket/infrastructure-changes-in-bitbucket-pipelines-872135046.html

It breaks a simple yum -y update and your account needs to be whitelisted in order for it to work until there is a documented workaround available.

[Philip Hodder]

The workaround I provided above should suffice. It's an issue with file permissions across Docker build instructions. If file modification is in a single instruction then the Docker build should work.

[stnor]

That's not quite right for this case.

This Dockerfile failed before my account was whitelisted:

https://bitbucket.org/selessia/docker-test/src/master/Dockerfile

https://bitbucket.org/selessia/docker-test/addon/pipelines/home#!/results/5

[Philip Hodder]

Weird... Thanks for that, I'll note it down as a potentially separate issue to investigate once the other user namespace issue is fixed.

[Philip Hodder]

Hi Stefan,

I suspect your question may be related to this one: https://community.atlassian.com/t5/Bitbucket-questions/rm-rf-inside-container-via-Bitbucket-pipeline/qaq-p/903061#M33507

Can you try combine all the RUN instructions into a single instruction? Like so:

FROM amazonlinux:latest

ENV TZ=Europe/Stockholm

##
## Timezone
##
RUN ln -snf /usr/share/zoneinfo/$TZ /etc/localtime && echo $TZ > /etc/timezone \
  && yum -y update \
  && yum -y install java-1.8.0-openjdk-headless shadow-utils.x86_64 tar unzip wget findutils awslog

Let me know if that workaround works for the time-being.

Thanks,

Phil

[stnor]

Hi Phil. Apparently Atlassian rolled out a security feature that broke my build. My account have been whitelisted, and as of now there is no documented workaround.

[Philip Hodder]

Just a quick update. This issue should be fixed now: https://community.atlassian.com/t5/Bitbucket-questions/rm-rf-inside-container-via-Bitbucket-pipeline/qaq-p/903061#M33802

Sorry for the inconvenience.