Merge branch 'master' into align-with-docker-ssh-agent-process

.github/dependabot.yml

@@ -2,20 +2,7 @@
 version: 2
 updates:
 
-# Alpine Linux
-- package-ecosystem: docker
-  directory: "alpine"
-  schedule:
-    interval: weekly
-  open-pull-requests-limit: 2
-  target-branch: master
-  reviewers:
-  - MarkEWaite
-  labels:
-  - dependencies
-
 # Arch Linux
-
 - package-ecosystem: docker
   directory: "archlinux"
   schedule:
@@ -27,44 +14,7 @@ updates:
   labels:
   - dependencies
 
-# Debian Linux
-
-- package-ecosystem: docker
-  directory: "debian"
-  schedule:
-    interval: weekly
-  open-pull-requests-limit: 2
-  target-branch: master
-  reviewers:
-  - MarkEWaite
-  labels:
-  - dependencies
-
-# Windows
-- package-ecosystem: docker
-  directory: "windows/nanoserver"
-  schedule:
-    interval: weekly
-  open-pull-requests-limit: 2
-  target-branch: master
-  reviewers:
-  - slide
-  labels:
-  - dependencies
-
-- package-ecosystem: docker
-  directory: "windows/windowsservercore"
-  schedule:
-    interval: weekly
-  open-pull-requests-limit: 2
-  target-branch: master
-  reviewers:
-  - slide
-  labels:
-  - dependencies
-
 # GitHub actions
-
 - package-ecosystem: "github-actions"
   target-branch: master
   directory: "/"

.github/workflows/updatecli.yaml

@@ -15,7 +15,7 @@ jobs:
         uses: actions/checkout@v4
 
       - name: Install Updatecli in the runner
-        uses: updatecli/updatecli-action@v2.65.0
+        uses: updatecli/updatecli-action@v2.67.0
 
       - name: Run Updatecli in Dry Run mode
         run: updatecli diff --config ./updatecli/updatecli.d --values ./updatecli/values.github-action.yaml

README_agent.md

@@ -64,6 +64,11 @@ The image has several supported configurations, which can be accessed via the fo
       * `jenkins/agent:alpine-jdk17`
       * `jenkins/agent:latest-alpine`
       * `jenkins/agent:latest-alpine-jdk17`
+    * rhel-ubi9 (Based on Red Hat Universal Base Image 9)
+      * `jenkins/agent:rhel-ubi9`
+      * `jenkins/agent:rhel-ubi9-jdk17`
+      * `jenkins/agent:latest-rhel-ubi9`
+      * `jenkins/agent:latest-rhel-ubi9-jdk17`
   * Java 21:
     * bookworm (Based on `debian:bookworm-${builddate}`):
       * `jenkins/agent:bookworm`
@@ -75,6 +80,9 @@ The image has several supported configurations, which can be accessed via the fo
       * `jenkins/agent:alpine-jdk21`
       * `jenkins/agent:latest-alpine`
       * `jenkins/agent:latest-alpine-jdk21`
+    * rhel-ubi9 (Based on Red Hat Universal Base Image 9)
+      * `jenkins/agent:rhel-ubi9-jdk21`
+      * `jenkins/agent:latest-rhel-ubi9-jdk21`
   * Java 11:
     * bookworm (Based on `debian:bookworm-${builddate}`):
       * `jenkins/agent:bookworm`

README_inbound-agent.md

@@ -61,6 +61,7 @@ Optional environment variables:
 
 * `JENKINS_JAVA_BIN`: Path to Java executable to use instead of the default in PATH or obtained from JAVA_HOME
 * `JENKINS_JAVA_OPTS` : Java Options to use for the remoting process, otherwise obtained from JAVA_OPTS, **Warning** :exclamation: For more information on Windows usage, please see the **Windows Jenkins Java Opts** [section below](#windows-jenkins-java-opts).
+* `JENKINS_AGENT_FILE` : Jenkins agent jar file location, `/usr/share/jenkins/agent.jar` will be used if this is not set
 * `JENKINS_URL`: url for the Jenkins server, can be used as a replacement to `-url` option, or to set alternate jenkins URL
 * `JENKINS_TUNNEL`: (`HOST:PORT`) connect to this agent host and port instead of Jenkins server, assuming this one do route TCP traffic to Jenkins controller. Useful when when Jenkins runs behind a load balancer, reverse proxy, etc.
 * `JENKINS_SECRET`: (use only if not set as an argument) the secret as shown on the controller after creating the agent

adoptium-get-jdk-link.sh

@@ -73,7 +73,7 @@ for ARCH in ${ARCHS}; do
     # Fetch the download URL from the Adoptium API
     URL="https://api.adoptium.net/v3/binary/version/jdk-${ENCODED_ARCHIVE_DIRECTORY}/${OS_TYPE}/${ARCH}/jdk/hotspot/normal/eclipse?project=jdk"
 
-    if ! RESPONSE=$(curl -fsI "${URL}"); then
+    if ! RESPONSE=$(curl --fail --silent --show-error --retry 5 --retry-connrefused --head "${URL}"); then
         echo "Error: Failed to fetch the URL for architecture ${ARCH}. Exiting with status 1." >&2
         echo "Response: ${RESPONSE}" >&2
         exit 1
@@ -91,7 +91,7 @@ for ARCH in ${ARCHS}; do
 
     # Use curl to check if the URL is reachable
     # If the URL is not reachable, print an error message and exit the script with status 1
-    if ! curl -v -fs "${REDIRECTED_URL}" >/dev/null 2>&1; then
+    if ! curl --fail --silent --show-error --retry 5 --retry-connrefused "${REDIRECTED_URL}" >/dev/null 2>&1; then
         echo "${REDIRECTED_URL}" is not reachable for architecture "${ARCH}". >&2
         exit 1
     fi

adoptium-install-jdk.sh

@@ -28,7 +28,7 @@ if ! DOWNLOAD_URL=$("${SCRIPT_DIR}"/adoptium-get-jdk-link.sh "${JAVA_VERSION}" "
 fi
 
 # Use curl to download the JDK archive from the URL
-if ! curl --silent --location --output /tmp/jdk.tar.gz "${DOWNLOAD_URL}"; then
+if ! curl --silent --show-error --location --retry 5 --retry-connrefused --output /tmp/jdk.tar.gz "${DOWNLOAD_URL}"; then
     echo "Error: Failed to download the JDK archive. Exiting with status 1." >&2
     exit 1
 fi

alpine/Dockerfile

@@ -19,7 +19,7 @@
 #  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 #  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 #  THE SOFTWARE.
-ARG ALPINE_TAG=3.20.2
+ARG ALPINE_TAG=3.20.3
 FROM alpine:"${ALPINE_TAG}" AS jre-build
 
 SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
@@ -105,7 +105,7 @@ RUN mkdir -p /home/"${user}"/.jenkins && mkdir -p "${AGENT_WORKDIR}"
 VOLUME /home/"${user}"/.jenkins
 VOLUME "${AGENT_WORKDIR}"
 WORKDIR /home/"${user}"
-ENV user=${user}
+ENV USER=${user}
 LABEL \
     org.opencontainers.image.vendor="Jenkins project" \
     org.opencontainers.image.title="Official Jenkins Agent Base Docker image" \

archlinux/Dockerfile

@@ -20,7 +20,7 @@
 #  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 #  THE SOFTWARE.
 
-FROM archlinux:base-20240804.0.251467 AS jre-build
+FROM archlinux:base-20240922.0.264758 AS jre-build
 
 # This Build ARG is populated by Docker
 # Ref. https://docs.docker.com/engine/reference/builder/#automatic-platform-args-in-the-global-scope
@@ -52,7 +52,7 @@ RUN jlink \
   --compress=2 \
   --output /javaruntime
 
-FROM archlinux:base-20240804.0.251467
+FROM archlinux:base-20240922.0.264758
 
 ARG user=jenkins
 ARG group=jenkins
@@ -83,7 +83,7 @@ RUN mkdir /home/"${user}"/.jenkins && mkdir -p "${AGENT_WORKDIR}"
 VOLUME /home/"${user}"/.jenkins
 VOLUME "${AGENT_WORKDIR}"
 WORKDIR /home/"${user}"
-ENV user=${user}
+ENV USER=${user}
 LABEL \
     org.opencontainers.image.vendor="Jenkins project" \
     org.opencontainers.image.title="Official Jenkins Agent Base Docker image" \

debian/Dockerfile

@@ -19,7 +19,7 @@
 #  LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 #  OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 #  THE SOFTWARE.
-ARG DEBIAN_RELEASE=bookworm-20240722
+ARG DEBIAN_RELEASE=bookworm-20240904
 FROM debian:"${DEBIAN_RELEASE}"-slim as jre-build
 
 SHELL ["/bin/bash", "-e", "-u", "-o", "pipefail", "-c"]
@@ -116,7 +116,7 @@ RUN mkdir -p /home/"${user}"/.jenkins && mkdir -p "${AGENT_WORKDIR}"
 VOLUME /home/"${user}"/.jenkins
 VOLUME "${AGENT_WORKDIR}"
 WORKDIR /home/"${user}"
-ENV user=${user}
+ENV USER=${user}
 LABEL \
   org.opencontainers.image.vendor="Jenkins project" \
   org.opencontainers.image.title="Official Jenkins Agent Base Docker image" \

docker-bake.hcl

@@ -116,15 +116,19 @@ variable "ON_TAG" {
 }
 
 variable "ALPINE_FULL_TAG" {
-  default = "3.20.2"
+  default = "3.20.3"
 }
 
 variable "ALPINE_SHORT_TAG" {
   default = regex_replace(ALPINE_FULL_TAG, "\\.\\d+$", "")
 }
 
 variable "DEBIAN_RELEASE" {
-  default = "bookworm-20240722"
+  default = "bookworm-20240904"
+}
+
+variable "UBI9_TAG" {
+  default = "9.4-1214.1726694543"
 }
 
 # Set this value to a specific Windows version to override Windows versions to build returned by windowsversions function
@@ -179,7 +183,6 @@ function "debian_platforms" {
   : ["linux/amd64", "linux/arm64", "linux/ppc64le", "linux/s390x"]))
 }
 
-
 # Return array of Windows version(s) to build
 # There is no mcr.microsoft.com/windows/servercore:1809 image
 # Can be overriden by setting WINDOWS_VERSION_OVERRIDE to a specific Windows version
@@ -211,6 +214,13 @@ function "toolsversion" {
     : version)
 }
 
+# Return an array of RHEL UBI 9 platforms to use depending on the jdk passed as parameter
+# Note: Jenkins controller container image only supports jdk17 and jdk21 for ubi9
+function "rhel_ubi9_platforms" {
+  params = [jdk]
+  result = ["linux/amd64", "linux/arm64", "linux/ppc64le"]
+}
+
 target "alpine" {
   matrix = {
     type = agent_types_to_build
@@ -294,6 +304,34 @@ target "agent_archlinux_jdk11" {
   platforms = ["linux/amd64"]
 }
 
+target "rhel_ubi9" {
+  matrix = {
+    type = ["agent", "inbound-agent"]
+    jdk  = [17, 21]
+  }
+  name       = "${type}_rhel_ubi9_jdk${jdk}"
+  target     = type
+  dockerfile = "rhel/ubi9/Dockerfile"
+  context    = "."
+  args = {
+    UBI9_TAG       = UBI9_TAG
+    VERSION        = REMOTING_VERSION
+    JAVA_VERSION   = "${javaversion(jdk)}"
+  }
+  tags = [
+    # If there is a tag, add versioned tag suffixed by the jdk
+    equal(ON_TAG, "true") ? "${REGISTRY}/${orgrepo(type)}:${REMOTING_VERSION}-${BUILD_NUMBER}-rhel-ubi9-jdk${jdk}" : "",
+    # If there is a tag and if the jdk is the default one, add versioned short tag
+    equal(ON_TAG, "true") ? (is_default_jdk(jdk) ? "${REGISTRY}/${orgrepo(type)}:${REMOTING_VERSION}-${BUILD_NUMBER}-rhel-ubi9" : "") : "",
+    # If the jdk is the default one, add rhel and latest short tags
+    is_default_jdk(jdk) ? "${REGISTRY}/${orgrepo(type)}:rhel-ubi9" : "",
+    is_default_jdk(jdk) ? "${REGISTRY}/${orgrepo(type)}:latest-rhel-ubi9" : "",
+    "${REGISTRY}/${orgrepo(type)}:rhel-ubi9-jdk${jdk}",
+    "${REGISTRY}/${orgrepo(type)}:latest-rhel-ubi9-jdk${jdk}",
+  ]
+  platforms = rhel_ubi9_platforms(jdk)
+}
+
 target "nanoserver" {
   matrix = {
     type = windowsagenttypes(WINDOWS_AGENT_TYPE_OVERRIDE)

jenkins-agent

@@ -26,6 +26,7 @@
 # Optional environment variables :
 # * JENKINS_JAVA_BIN : Java executable to use instead of the default in PATH or obtained from JAVA_HOME
 # * JENKINS_JAVA_OPTS : Java Options to use for the remoting process, otherwise obtained from JAVA_OPTS
+# * JENKINS_AGENT_FILE : Jenkins agent jar file location, /usr/share/jenkins/agent.jar will be used if this is not set
 # * REMOTING_OPTS : Generic way to pass additional CLI options to agent.jar (see -help)
 #
 # Deprecated environment variables (prefer setting REMOTING_OPTS)
@@ -109,6 +110,12 @@ else
 		fi
 	fi
 
+	if [ "$JENKINS_AGENT_FILE" ]; then
+		AGENT_FILE="$JENKINS_AGENT_FILE"
+	else
+		AGENT_FILE="/usr/share/jenkins/agent.jar"
+	fi
+
 	# if both required options are defined, do not pass the parameters
 	if [ -n "$JENKINS_SECRET" ]; then
 		case "$@" in
@@ -129,6 +136,6 @@ else
 	#TODO: Handle the case when the command-line and Environment variable contain different values.
 	#It is fine it blows up for now since it should lead to an error anyway.
 
-        exec $JAVA_BIN $JAVA_OPTIONS -jar /usr/share/jenkins/agent.jar $SECRET $AGENT_NAME $TUNNEL $URL $WORKDIR $WEB_SOCKET $DIRECT $PROTOCOLS $INSTANCE_IDENTITY $REMOTING_OPTS "$@"
+        exec $JAVA_BIN $JAVA_OPTIONS -jar $AGENT_FILE $SECRET $AGENT_NAME $TUNNEL $URL $WORKDIR $WEB_SOCKET $DIRECT $PROTOCOLS $INSTANCE_IDENTITY $REMOTING_OPTS "$@"
 
 fi