2.303.1.6-ra

Dockerfile

@@ -19,7 +19,8 @@ ARG AGENT_WORKDIR=/home/${user}/agent
 RUN dnf update -y --nodocs && \
     dnf install -y --nodocs \
         nss_wrapper \
-        git `# commonly used outside a container step (see JENKINS-30600), and traditionally part of openjdk:8-jdk` && \
+        git `# commonly used outside a container step (see JENKINS-30600), and traditionally part of openjdk:8-jdk` \
+        git-lfs && \
     dnf -y clean all
 
 WORKDIR /home/${user}
@@ -29,9 +30,7 @@ ENTRYPOINT ["entrypoint", "jenkins-agent"]
 COPY files.tar /tmp
 RUN cd / && tar xvf /tmp/files.tar && rm /tmp/files.tar
 COPY scripts/ /
-RUN rpm -i /rpms/*.rpm && \
-    rm -rf /rpms && \
-    chmod 755 /usr/share/jenkins && \
+RUN chmod 755 /usr/share/jenkins && \
     chmod 644 /usr/share/jenkins/agent.jar && \
     chmod a+x /usr/local/bin/* && \
     chmod ug-s /usr/libexec/openssh/ssh-keysign && \

README.md

@@ -12,7 +12,7 @@ CloudBees CI (formerly known as _CloudBees Core_) consists of three Docker image
 For each image, all files other than UBI and native packages
 are included in a `files.tar` marked with a SHA-256 checksum.
 
-A version of CloudBees CI is given in the format `2.289.3.2-ra`
+A version of CloudBees CI is given in the format `2.303.1.6-ra`
 where the first three components are aligned with a Jenkins LTS.
 The Helm chart is coversioned with `core-oc`.
 The `core-mm` image typically shares the same version,
@@ -25,13 +25,13 @@ plus whatever other customizations are desired:
 ```yaml
 OperationsCenter:
   Image:
-    dockerImage: your-registry/core-oc:2.289.3.2-ra
+    dockerImage: your-registry/core-oc:2.303.1.6-ra
 Master:
   Image:
-    dockerImage: your-registry/core-mm:2.289.3.2-ra
+    dockerImage: your-registry/core-mm:2.303.1.6-ra
 Agents:
   Image:
-    dockerImage: your-registry/agent:2.289.3.2-ra
+    dockerImage: your-registry/agent:2.303.1.6-ra
 ```
 
 and [install via Helm 3](https://docs.cloudbees.com/docs/cloudbees-core/latest/kubernetes-install-guide/installing-kubernetes-using-helm) using the local copy of the chart:

hardening_manifest.yaml

 apiVersion: v1
 name: "cloudbees/core/agent"
 tags:
-- "2.289.3.2-ra"
+- "2.303.1.6-ra"
 - latest
 labels:
   org.opencontainers.image.title: "agent"
@@ -9,7 +9,7 @@ labels:
   org.opencontainers.image.licenses: proprietary
   org.opencontainers.image.url: https://docs.cloudbees.com/docs/cloudbees-ci/
   org.opencontainers.image.vendor: CloudBees
-  org.opencontainers.image.version: "2.289.3.2-ra"
+  org.opencontainers.image.version: "2.303.1.6-ra"
   mil.dso.ironbank.image.keywords: cicd
   mil.dso.ironbank.image.type: commercial
   mil.dso.ironbank.product.name: CloudBees CI
@@ -18,10 +18,10 @@ args:
   BASE_TAG: "1.8.0"
 resources:
 - filename: files.tar
-  url: https://downloads.cloudbees.com/dsop-files/agent-files-48216a0ee1c8d75dcdc7a642572585d988ce9d4f226da727ba5bef8f86ac522f.tar
+  url: https://downloads.cloudbees.com/dsop-files/agent-files-ecf1ac265d190164d4b48231277b03ce2798b7a93f6360ac69deb0cd5084ecbe.tar
   validation:
     type: sha256
-    value: "48216a0ee1c8d75dcdc7a642572585d988ce9d4f226da727ba5bef8f86ac522f"
+    value: "ecf1ac265d190164d4b48231277b03ce2798b7a93f6360ac69deb0cd5084ecbe"
 maintainers:
 - email: productivity-team@cloudbees.com
   name: CloudBees

scripts/usr/local/bin/jenkins-agent

@@ -24,6 +24,7 @@
 
 # Usage jenkins-agent.sh [options] -url http://jenkins [SECRET] [AGENT_NAME]
 # Optional environment variables :
+# * JENKINS_JAVA_BIN : Java executable to use instead of the default in PATH or obtained from JAVA_HOME
 # * JENKINS_TUNNEL : HOST:PORT for a tunnel to route TCP traffic to jenkins host, when jenkins can't be directly accessed over network
 # * JENKINS_URL : alternate jenkins URL
 # * JENKINS_SECRET : agent secret, if not set as an argument
@@ -36,9 +37,9 @@
 #                              the agent skips connecting to an HTTP(S) port for connection info.
 # * JENKINS_PROTOCOLS:         Specify the remoting protocols to attempt when instanceIdentity is provided.
 
-if [ $# -eq 1 ]; then
+if [ $# -eq 1 ] && [ "${1#-}" == "$1" ] ; then
 
-	# if `docker run` only has one arguments, we assume user is running alternate command like `bash` to inspect the image
+	# if `docker run` only has one arguments and it is not an option as `-help`, we assume user is running alternate command like `bash` to inspect the image
 	exec "$@"
 
 else
@@ -85,10 +86,14 @@ else
 		INSTANCE_IDENTITY="-instanceIdentity $JENKINS_INSTANCE_IDENTITY"
 	fi
 
-	# if java home is defined, use it
-	JAVA_BIN="java"
-	if [ "$JAVA_HOME" ]; then
-		JAVA_BIN="$JAVA_HOME/bin/java"
+	if [ "$JENKINS_JAVA_BIN" ]; then
+		JAVA_BIN="$JENKINS_JAVA_BIN"
+	else
+		# if java home is defined, use it
+		JAVA_BIN="java"
+		if [ "$JAVA_HOME" ]; then
+			JAVA_BIN="$JAVA_HOME/bin/java"
+		fi
 	fi
 
 	# if both required options are defined, do not pass the parameters