Revert rootful agent images again (#4683)

Co-authored-by: Robert Kaussow <mail@thegeeklab.de>

.woodpecker/docker.yaml

@@ -212,7 +212,7 @@ steps:
     image: *buildx_plugin
     settings:
       repo: woodpeckerci/woodpecker-agent
-      dockerfile: docker/Dockerfile.agent.alpine.multiarch.rootless
+      dockerfile: docker/Dockerfile.agent.alpine.multiarch
       platforms: *platforms_preview
       tag: pull_${CI_COMMIT_PULL_REQUEST}-alpine
       build_args: *build_args
@@ -226,7 +226,7 @@ steps:
     settings:
       dry_run: true
       repo: woodpeckerci/woodpecker-agent
-      dockerfile: docker/Dockerfile.agent.multiarch.rootless
+      dockerfile: docker/Dockerfile.agent.multiarch
       platforms: *platforms_preview
       tag: pull_${CI_COMMIT_PULL_REQUEST}
       build_args: *build_args
@@ -241,7 +241,7 @@ steps:
     image: *buildx_plugin
     settings:
       repo: *publish_repos_agent
-      dockerfile: docker/Dockerfile.agent.multiarch.rootless
+      dockerfile: docker/Dockerfile.agent.multiarch
       platforms: *platforms_release
       tag: [next, 'next-${CI_COMMIT_SHA:0:10}']
       logins: *publish_logins
@@ -260,7 +260,7 @@ steps:
     image: *buildx_plugin
     settings:
       repo: *publish_repos_agent
-      dockerfile: docker/Dockerfile.agent.alpine.multiarch.rootless
+      dockerfile: docker/Dockerfile.agent.alpine.multiarch
       platforms: *platforms_alpine
       tag: [next-alpine, 'next-${CI_COMMIT_SHA:0:10}-alpine']
       logins: *publish_logins
@@ -276,7 +276,7 @@ steps:
     image: *buildx_plugin
     settings:
       repo: *publish_repos_agent
-      dockerfile: docker/Dockerfile.agent.multiarch.rootless
+      dockerfile: docker/Dockerfile.agent.multiarch
       platforms: *platforms_release
       tag: ['${CI_COMMIT_TAG%%.*}', '${CI_COMMIT_TAG%.*}', '${CI_COMMIT_TAG}']
       logins: *publish_logins
@@ -292,7 +292,7 @@ steps:
     image: *buildx_plugin
     settings:
       repo: *publish_repos_agent
-      dockerfile: docker/Dockerfile.agent.alpine.multiarch.rootless
+      dockerfile: docker/Dockerfile.agent.alpine.multiarch
       platforms: *platforms_alpine
       tag: ['${CI_COMMIT_TAG%%.*}-alpine', '${CI_COMMIT_TAG%.*}-alpine', '${CI_COMMIT_TAG}-alpine']
       logins: *publish_logins

docker/Dockerfile.agent.alpine.multiarch

@@ -21,7 +21,5 @@ EXPOSE 3000
 
 COPY --from=build /src/dist/woodpecker-agent /bin/
 
-USER woodpecker
-
 HEALTHCHECK CMD ["/bin/woodpecker-agent", "ping"]
 ENTRYPOINT ["/bin/woodpecker-agent"]

docker/Dockerfile.agent.multiarch

@@ -26,7 +26,5 @@ COPY --from=build /etc/woodpecker /etc
 COPY --from=build /etc/passwd /etc/passwd
 COPY --from=build /etc/group /etc/group
 
-USER woodpecker
-
 HEALTHCHECK CMD ["/bin/woodpecker-agent", "ping"]
 ENTRYPOINT ["/bin/woodpecker-agent"]

docs/docs/30-administration/04-image-variants.md

@@ -8,7 +8,7 @@ This was done to prevent accidental major version upgrades.
 - `vX.Y.Z`: SemVer tags for specific releases, no entrypoint shell (scratch image)
   - `vX.Y`
   - `vX`
-- `vX.Y.Z-alpine`: SemVer tags for specific releases, based on Alpine, rootless (as of v3.0).
+- `vX.Y.Z-alpine`: SemVer tags for specific releases, based on Alpine, rootless for Server and CLI (as of v3.0).
   - `vX.Y-alpine`
   - `vX-alpine`
 - `next`: Built from the `main` branch

docs/docs/92-development/07-guides.md

@@ -55,7 +55,7 @@ You can try to use the `build-server` rule instead, however this one fails for s
 make build-agent
 
 ### build the image
-docker buildx build --platform linux/amd64 -t username/repo:tag -f docker/Dockerfile.agent.multiarch.rootless --push .
+docker buildx build --platform linux/amd64 -t username/repo:tag -f docker/Dockerfile.agent.multiarch --push .
 ```
 
 ### CLI

docs/src/pages/migrations.md

@@ -176,9 +176,16 @@ The following restructuring was done to achieve a more consistent grouping:
 
 #### Rootless images
 
-All Woodpecker images now use a non-privileged user (`woodpecker`) by default.
+The `server` and `cli` images now use a non-privileged user (`woodpecker`) by default.
 If you have volume mounts attached to containers, you might need to update the ownership of these directories from `root` to `woodpecker`.
 
+:::note
+The agent image must remain rootful by default to be able to mount the Docker socket when Woodpecker is used with the `docker` backend.
+The helm chart will start to use a non-privileged user by utilizing `securityContext`.
+Running a completely rootless agent with the `docker` backend may be possible by using a rootless docker daemon.
+However, this requires more work and is currently not supported.
+:::
+
 ## 2.7.2
 
 To secure your instance, set `WOODPECKER_PLUGINS_PRIVILEGED` to only allow specific versions of the `woodpeckerci/plugin-docker-buildx` plugin, use version 5.0.0 or above. This prevents older, potentially unstable versions from being privileged.