Create
cancel
Showing results for 
Search instead for 
Did you mean: 
Sign up Log in

It's not the same without you

Join the community to find out what other Atlassian users are discussing, debating and creating.

Atlassian Community Hero Image Collage

whats happens when we disable the bamboo security feature to "Process Bamboo Specs in Docker"? Edited

What happens if I am not Isolating the processing of Bamboo Specs by disabling this feature?

In my environment I cannot/don't want to install docker on my bamboo server(because bamboo itself is containerized, since docker in docker can get a bit messy). So in order to process the bamboo specs, i see that we have to disable the security feature to "Process Bamboo Specs in Docker".

I see that Atlassian doesnt recoment doing this. Can someone please explain me why and What are the cons of disabling this security settings? 

@Alexey Chystoprudov Kindly help me closing this.

Thanks!

1 answer

1 accepted

1 vote
Answer accepted

When Bamboo see changes in repository it runs such steps:

  1. Checkout source code
  2. Run Maven tool to compile and run Bamboo Specs generator to produce internal YAML
  3.  Read YAML and build plan/deployment structure and apply them to configuration.

Step #2 is very danger from security point of view. It takes Java code outside of Bamboo control (remote repository) and executes it inside Bamboo server. To make sure environment is fully isolated Bamboo team recommends to use Docker to divide Maven execution from Bamboo Server environment.

If you can't use Docker then Bamboo Server will try to do the most safe action and run Maven with custom Java Security Manager which don't allow to access network, execute other applications or read/write files outside of working directory by Java code. But we think that this barrier might be not enough to make you server fully secured.

Suggest an answer

Log in or Sign up to answer
TAGS
Community showcase
Published in Bamboo

Bamboo 7.1 is here and is packed with value!

I'm happy to announce that Bamboo 7.1 has been released and it’s overflowing with awesome new features. Top-voted issues First and foremost, a bunch of JAC top voted issues has been delivered - y...

587 views 1 6
Read article

Community Events

Connect with like-minded Atlassian users at free events near you!

Find an event

Connect with like-minded Atlassian users at free events near you!

Unfortunately there are no Community Events near you at the moment.

Host an event

You're one step closer to meeting fellow Atlassian users at your local event. Learn more about Community Events

Events near you