Come for the products,
stay for the community

The Atlassian Community can help you and your team get more value out of Atlassian products and practices.

Atlassian Community about banner
4,300,565
Community Members
 
Community Events
165
Community Groups

Bamboo does not clean up orphaned processes - security issue

Edited

Hi all,

On both windows and linux agents and the latest version of Bamboo, it is very simple to detach a process from the parent bamboo build process, so that it continues to run after the build returns.

One can observe this for example with gradle builds, whereby the gradle deamon will stay running on the agent in the background. Windows generally launches processes in a detached mode, so if a build plan does a "Start-Process notepad", the notepad will stay open after the build returns. Same for linux. Very easy to detach, e.g. a sleep command with /bin/bash -c 'sleep 60  > /dev/null 2>&1 &'.

While this can be a stability issue for agents, it is a pretty sever security issue. A rogue process running on the remote agent can spy on anything that a subsequent build plan is executing. This may be passwords (even if passed by the plan as "password/secret variables", these values are stored as simple environment variables on the remote agent while a build is executing), or confidential source code in the build directory, just to name two prominent candidates.

I wonder how other companies are dealing with this problem? Has anyone found a good solution / written a plugin that takes care of the cleanup in a reliable way? Or are you opting for completely different architectures like "disposable" agents (run agents as containers and re-instantiate after each build)? 

Atlassian Bamboo team, is this on your radar? What is your take on this? We investigated the same behavior in VSTS, which is reliably cleaning up orphan processes after the build. Not sure about other CI/CD platforms.

Thanks

 

1 comment

Hi @Johannes A, I think the future is run agents as containers, in bamboo you are ready to run build process in docker support is a perfect way to  isolated each build.

Cheers.

Omar H.

Comment

Log in or Sign up to comment
TAGS
Community showcase
Published in Bamboo

Bamboo Data Center on Kubernetes

Hi, If you are running self-managed environments and looking to adopt modern infrastructure, Bamboo Data Center can now be deployed in a Kubernetes cluster. By leveraging Kubernetes, you can easily...

968 views 3 8
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you