agentic-forges/forgejo-mcp

Watch

Fork 0

fix: 🐛 rootless buildah in build-image task for OpenShift SCC #161

Merged

goern merged 0 commits from refs/pull/161/head into main

2026-05-25 23:11:24 +00:00

goern commented

2026-05-25 23:10:52 +00:00

(Migrated from codeberg.org)

Problem

build-image.yaml sets securityContext.privileged: true. The pipeline ServiceAccount in op1st-pipelines has only container-build SCC bound, which explicitly rejects privileged: true. PipelineRun release-tools-on-tag-publish-v1-0-1 failed at build-image with PodAdmissionFailed.

Fix

Remove securityContext.privileged: true
Add runAsUser: 1000 / runAsGroup: 1000 — accepted by container-build SCC
Add --isolation=chroot to buildah bud — rootless isolation mode that works without kernel namespaces, sufficient for chroot syscall which container-build permits
Keep --storage-driver=vfs (default) — no overlay kernel module needed
Add ISOLATION param (default chroot) for future override if a cluster grants stronger SCCs

Closes forgejo-mcp-aps

## Problem `build-image.yaml` sets `securityContext.privileged: true`. The `pipeline` ServiceAccount in `op1st-pipelines` has only `container-build` SCC bound, which explicitly rejects `privileged: true`. PipelineRun `release-tools-on-tag-publish-v1-0-1` failed at `build-image` with `PodAdmissionFailed`. ## Fix - Remove `securityContext.privileged: true` - Add `runAsUser: 1000` / `runAsGroup: 1000` — accepted by `container-build` SCC - Add `--isolation=chroot` to `buildah bud` — rootless isolation mode that works without kernel namespaces, sufficient for `chroot` syscall which `container-build` permits - Keep `--storage-driver=vfs` (default) — no overlay kernel module needed - Add `ISOLATION` param (default `chroot`) for future override if a cluster grants stronger SCCs Closes forgejo-mcp-aps

op1st-gitops commented

2026-05-25 23:10:55 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-tq5ck is running.

Starting Pipelinerun on-pull-request-tq5ck in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines on-pull-request-tq5ck -f

op1st Pipelines as Code/on-pull-request-tq5ck is running. Starting Pipelinerun <b>[on-pull-request-tq5ck](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tq5ck)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tq5ck) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines on-pull-request-tq5ck -f</code>

op1st-gitops commented

2026-05-25 23:10:55 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-8kpcg is running.

Starting Pipelinerun code-scans-8kpcg in namespace op1st-pipelines

You can monitor the execution using the op1st Pipelines as Code PipelineRun viewer or through the command line by
using the tkn CLI with the following command:

tkn pr logs -n op1st-pipelines code-scans-8kpcg -f

op1st Pipelines as Code/code-scans-8kpcg is running. Starting Pipelinerun <b>[code-scans-8kpcg](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-8kpcg)</b> in namespace <b>op1st-pipelines</b> You can monitor the execution using the [op1st Pipelines as Code](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-8kpcg) PipelineRun viewer or through the command line by using the [tkn](https://tekton.dev/docs/cli/#installation) CLI with the following command: <code>tkn pr logs -n op1st-pipelines code-scans-8kpcg -f</code>

op1st-gitops commented

2026-05-25 23:11:26 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/code-scans-8kpcg

Namespace: op1st-pipelines
PipelineRun: code-scans-8kpcg

Task Statuses:

Status	Duration	Name
Failed	30 seconds	fetch-source
Succeeded	10 seconds	gitleaks-version

Failure snippet:

task fetch-source has the status "TaskRunCancelled":

TaskRun "code-scans-8kpcg-fetch-source" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.

op1st Pipelines as Code/code-scans-8kpcg <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-8kpcg">code-scans-8kpcg</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Failed</td> <td>30 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-8kpcg/logs/fetch-source) </td></tr> <tr> <td>Succeeded</td> <td>10 seconds</td><td> [gitleaks-version](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/code-scans-8kpcg/logs/gitleaks-version) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>fetch-source</b> has the status <b>"TaskRunCancelled"</b>: <pre>TaskRun "code-scans-8kpcg-fetch-source" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.</pre>

op1st-gitops commented

2026-05-25 23:11:27 +00:00

(Migrated from codeberg.org)

op1st Pipelines as Code/on-pull-request-tq5ck

Namespace: op1st-pipelines
PipelineRun: on-pull-request-tq5ck

Task Statuses:

Status	Duration	Name
Succeeded	14 seconds	fetch-source
Failed	15 seconds	build-and-test

Failure snippet:

task build-and-test has the status "TaskRunCancelled":

TaskRun "on-pull-request-tq5ck-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.

op1st Pipelines as Code/on-pull-request-tq5ck <ul> <li><b>Namespace</b>: <a href="https://detailurl.setting.custom-console-url-namespace.is.not.configured">op1st-pipelines</a></li> <li><b>PipelineRun:</b> <a href="https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tq5ck">on-pull-request-tq5ck</a></li> </ul> <hr> <h4>Task Statuses:</h4> <table> <tr><th>Status</th><th>Duration</th><th>Name</th></tr> <tr> <td>Succeeded</td> <td>14 seconds</td><td> [fetch-source](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tq5ck/logs/fetch-source) </td></tr> <tr> <td>Failed</td> <td>15 seconds</td><td> [build-and-test](https://console-openshift-console.apps.nostromo.erdgeschoss.b4mad.emea.operate-first.cloud/k8s/ns/op1st-pipelines/tekton.dev~v1~PipelineRun/on-pull-request-tq5ck/logs/build-and-test) </td></tr> </table> <hr> <h4>Failure snippet:</h4> task <b>build-and-test</b> has the status <b>"TaskRunCancelled"</b>: <pre>TaskRun "on-pull-request-tq5ck-build-and-test" was cancelled. TaskRun cancelled as the PipelineRun it belongs to has been cancelled.</pre>

No reviewers

No milestone

No project

No assignees

1 participant

Notifications

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference

agentic-forges/forgejo-mcp!161

No description provided.

Rows
Columns