Securing Builds by Strategy

You are viewing documentation for a release that is no longer supported. The latest supported version of version 3 is [3.11]. For the most recent version 4, see

Builds in OKD are run in that have access to the Docker daemon socket. As a security measure, it is recommended to limit who can run builds and the strategy that is used for those builds. Custom builds are inherently less safe than , given that they can execute any code in the build with potentially full access to the node’s Docker socket, and as such are disabled by default. Docker build permission should also be granted with caution as a vulnerability in the Docker build logic could result in a privileges being granted on the host node.

By default, all users that can create builds are granted permission to use the Docker and Source-to-Image build strategies. Users with privileges can enable the Custom build strategy, as referenced in the Restricting Build Strategies to a User Globally section of this page.

You can control who can build with what build strategy using an . Each build strategy has a corresponding build subresource. A user must have permission to create a build and permission to create on the build strategy subresource in order to create builds using that strategy. Default roles are provided which grant the create permission on the build strategy subresource.

To prevent access to a particular build strategy globally, log in as a user with cluster-admin privileges, remove the corresponding role from the system:authenticated group, and apply the annotation to protect them from changes between the API restarts. The following example shows disabling the docker build strategy.

1. Apply the openshift.io/reconcile-protect annotation

2. Remove the role:

   $ oc adm policy remove-cluster-role-from-group system:build-strategy-docker system:authenticated

Ensure the build strategy subresources are also removed from these roles:

For each role, remove the line that corresponds to the resource of the strategy to disable.

Disable the Docker Build Strategy for admin

metadata:
  name: admin
...
- resources:
  - builds/custom
  - builds/docker (1)
  ...

To allow only a set of specific users to create builds with a particular strategy:

1. .

2. Assign the role corresponding to the build strategy to a specific user. For example, to add the system:build-strategy-docker cluster role to the user devuser:

Similar to granting the build strategy role to a user globally, to allow only a set of specific users within a project to create builds with a particular strategy:

1. Disable global access to the build strategy.

2. $ oc adm policy add-role-to-user system:build-strategy-docker devuser -n devproject