I'm testing this comfiguration; after many plugins additions i have a good performance, except for some minor bugs, all is well.

In this case i want ask about this warning:

You no longer need to configure Docker TLS keys, this setup runs a "Proxy" container against your docker host that works around the TLS security. PLEASE NOTE: DO NOT USE IN PRODUCTION. This is a convenience proxy to make sure things work out of the box on Docker-toolbox, Docker for Mac or Docker for Windows without fuss!

In the production case which is the better setup?

Is there a link to the grafana dashboards at the bottom of https://engineering.riotgames.com/news/building-jenkins-inside-ephemeral-docker-container?

@maxfields2000 I put in the 'best practice items per this article: https://engineering.riotgames.com/news/putting-jenkins-docker-container
I think the advice is pretty good, but since the image from cloudbees calls the VOLUME Command this has to be updated to work, please review my example maybe I translated it incorrectly.

@rtyler can you review, maybe this steps and see if you think they are best practice or I should remove them and not worry about them..

Create a log for jenkins (best practice) per Mayfield Stewart

RUN mkdir /var/log/jenkins
RUN chown -R jenkins:jenkins /var/log/jenkins
RUN mkdir /var/cache/jenkins
RUN chown -R jenkins:jenkins /var/cache/jenkins
ENV JAVA_OPTS -Xmx8192m
ENV JENKINS_OPTS --handlerCountStartup=100 --handlerCountMax=300 --logfile=/var/log/jenkins/jenkins.log --webroot=/var/cache/jenkins/war

Example: https://github.com/capitalone/Hygieia/tree/master/test-servers/jenkins

But on my image it does work, maybe I am doing something wrong but I think we issue due to permissions as the VOLUME command is run in the base image so the clowns above dont work.. I think this all has to be in the extension point.

Hi, firstly thanks a lot for writing the tutorial ! and I found the tutorial in jenkins2 is for local Docker-Toolbox version of a fully ephemeral jenkins environment(tested up to Docker 1.11). while now docker is 1.13 and docker for mac is ready. recently I tried a lot on docker(1.13) for mac and met some questions, such as: YADP plugin can not connect to docker damon in jenkins, no .docker under $home folder ..etc so just wonder if there is plan for updating the tutorial which will be great help. thanks in advance

On OSX 10.11.5, running 1.12.0-rc4, build e4a0dbc, experimental, creating of the jenkins_slave fails with:

Error in provisioning; template='DockerTemplate{configVersion=2, labelString='testslave', launcher=com.nirima.jenkins.plugins.docker.launcher.DockerComputerSSHLauncher@52deb96, remoteFsMapping='/home/jenkins', remoteFs='/home/jenkins', instanceCap=1, mode=EXCLUSIVE, retentionStrategy=com.nirima.jenkins.plugins.docker.strategy.DockerOnceRetentionStrategy@4e4e5b9e, numExecutors=1, dockerTemplateBase=DockerTemplateBase{image=jenkins_slave}, removeVolumes=false, pullStrategy=PULL_LATEST}' for cloud='Local Docker' com.github.dockerjava.api.BadRequestException: {"message":"starting container with HostConfig was deprecated since v1.10 and removed in v1.12"}

Additionally, jenkins_data crashes.

Don't have a clue yet why. Maybe you have an idea on how to resolve?

Hi @maxfields2000

Thanks for your great tutorial.

I have this error:

Sep 28, 2016 7:07:57 AM INFO com.github.kostyasha.yad.DockerCloud provision

Asked to provision load: '1', for: 'docker-slave' label

Sep 28, 2016 7:07:57 AM INFO com.github.kostyasha.yad.DockerCloud provision

Will provision 'jenkins_slave_1', for label: 'docker-slave', in cloud: 'Local DockerHost'

Sep 28, 2016 7:07:57 AM INFO com.github.kostyasha.yad.DockerCloud addProvisionedSlave

Provisioning 'jenkins_slave_1' number '0' on 'Local DockerHost'; Total containers: '0'

Sep 28, 2016 7:07:57 AM INFO com.github.kostyasha.yad.DockerCloud provisionWithWait

Trying to run container for jenkins_slave_1

Sep 28, 2016 7:07:57 AM SEVERE com.github.kostyasha.yad_docker_java.com.github.dockerjava.core.async.ResultCallbackTemplate onError

Error during callback
com.github.kostyasha.yad_docker_java.com.github.dockerjava.api.exception.NotFoundException: {"message":"No such image: jenkins_slave_1:latest"}

I don't know why, but Yer another Docker Plugin can provide the slave container.

I have this in settings:

As you can see i put the same docker image than i have in my terminal:

jenkins_slave_1.

I tried with jenkins_slave but doesn't works.

I don't know what have i wrong.

I'm using docker 1.12.1 and jenkins 2.23, with lastest Yer another Docker Plugin.

And not, isn't connection problem, see:

I have this Dockerfile for jenkins-slave image:

FROM debian:jessie
MAINTAINER José L. Sandoval A.

# Install all dependencies
RUN echo 'deb http://httpredir.debian.org/debian jessie-backports main' > /etc/apt/sources.list.d/jessie-backports.list

ENV JAVA_VERSION 8u102
ENV JAVA_DEBIAN_VERSION 8u102-b14.1-1~bpo8+1

# see https://bugs.debian.org/775775
# and https://github.com/docker-library/java/issues/19#issuecomment-70546872
ENV CA_CERTIFICATES_JAVA_VERSION 20140324

# Install Essentials and Packages
RUN apt-get update \
    && apt-get install -y gettext git wget \
    openssh-server openjdk-8-jdk="$JAVA_DEBIAN_VERSION"\
    ca-certificates-java="$CA_CERTIFICATES_JAVA_VERSION" \
    sudo \
    && apt-get autoremove -y --purge \
    && rm -rf /var/lib/apt/lists/*

RUN /var/lib/dpkg/info/ca-certificates-java.postinst configure

# Create Jenkins User
RUN useradd jenkins -m -s /bin/bash

RUN chown -R jenkins /home/jenkins
RUN chgrp -R jenkins /home/jenkins

# Add the jenkins user to sudoers
RUN echo "jenkins    ALL=(ALL)    ALL" >> etc/sudoers

# Set Name Servers
COPY /files/resolv.conf /etc/resolv.conf

Thanks!

Not sure what I am doing wrong but in the step where I try to connect to http data source for the graphite it says http error not found. I followed the directions exactly and tried to modify troubleshoot but I am not getting very far. I wonder if something changed since 2 years ago?

07/06/16 17:52:51] [SSH] Opening SSH connection to 192.168.99.100:32792.
ERROR: Server rejected the 1 private key(s) for jenkins (credentialId:f89770c5-b0d6-411b-b348-3c0c63b89c4d/method:publickey)
ERROR: Failed to authenticate as jenkins with credential=f89770c5-b0d6-411b-b348-3c0c63b89c4d
java.io.IOException: Publickey authentication failed.
    at com.trilead.ssh2.auth.AuthenticationManager.authenticatePublicKey(AuthenticationManager.java:315)
    at com.trilead.ssh2.Connection.authenticateWithPublicKey(Connection.java:467)
    at com.cloudbees.jenkins.plugins.sshcredentials.impl.TrileadSSHPublicKeyAuthenticator.doAuthenticate(TrileadSSHPublicKeyAuthenticator.java:109)
    at com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:408)
    at com.cloudbees.jenkins.plugins.sshcredentials.SSHAuthenticator.authenticate(SSHAuthenticator.java:428)
    at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1173)
    at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:701)
    at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:696)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)
Caused by: java.io.IOException: The connection is closed.
    at com.trilead.ssh2.auth.AuthenticationManager.deQueue(AuthenticationManager.java:63)
    at com.trilead.ssh2.auth.AuthenticationManager.getNextMessage(AuthenticationManager.java:86)
    at com.trilead.ssh2.auth.AuthenticationManager.authenticatePublicKey(AuthenticationManager.java:290)
    ... 11 more
Caused by: java.io.IOException: Cannot read full block, EOF reached.
    at com.trilead.ssh2.crypto.cipher.CipherInputStream.getBlock(CipherInputStream.java:81)
    at com.trilead.ssh2.crypto.cipher.CipherInputStream.read(CipherInputStream.java:108)
    at com.trilead.ssh2.transport.TransportConnection.receiveMessage(TransportConnection.java:232)
    at com.trilead.ssh2.transport.TransportManager.receiveLoop(TransportManager.java:693)
    at com.trilead.ssh2.transport.TransportManager$1.run(TransportManager.java:489)
    ... 1 more
[07/06/16 17:52:51] [SSH] Authentication failed.
hudson.AbortException: Authentication failed.
    at hudson.plugins.sshslaves.SSHLauncher.openConnection(SSHLauncher.java:1178)
    at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:701)
    at hudson.plugins.sshslaves.SSHLauncher$2.call(SSHLauncher.java:696)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
    at java.lang.Thread.run(Thread.java:745)
[07/06/16 17:52:51] Launch failed - cleaning up connection
[07/06/16 17:52:51] [SSH] Connection closed.

When the jenkins master attempts to connect to the slave I get the following error in the log. I've double checked that the correct public key is in the authorized_keys file. In addition if I try to connect directly I get:

System is booting up. See pam_nologin(8)

The keypair I am using was generated using the ssh-keygen -t rsa command on my host machine.

Hi @maxfields2000 I'm so thankful for this tutorial. I just a few inquiry.
Is it possible to deploy this to ECS?
Also if i use this for Production what would you recommend changing?

Thanks!
(Newbie for Jenkins and Docker)

Hey @maxfields2000 Max,

this is more a question around YADP but I was wondering whether you had (a) come across it (and maybe have a successful implementation) and (b) think its a good idea or not to assign multiple docker hosts to a single YADP Cloud under a load balancer.

I have also asked this question on the YADP issues log here : KostyaSha/yet-another-docker-plugin#183

What I want to do is provide a cluster of docker hosts assigned to a YADP Cloud that are available to spin up ephemeral slaves, ... to provide both scalability and resilience. I seem to recall that amongst your blog posts you suggested you were running a 'farm' of hosts for that purpose (but I could be making a leap here)

So, what I did was to use a value for the Docker URL property in the YADP Cloud specification to point to a load balancer (in my case and AWS ELB) under which there are multiple docker host instances.

My observed behaviour:

If I have a SINGLE instance under the ELB, slave containers launch successfully and run whatever job you ask them to, harvest the results and then terminate cleanly.

If I attach a second host to the ELB and execute a Jenkins job, multiple containers launch on BOTH hosts (and continue to do so until you abort the job).

In the Jenkins log you see lots of exception messages like this (with differing container ids) ...

Error during callback
com.github.kostyasha.yad_docker_java.com.github.dockerjava.api.exception.NotFoundException {"message":"No such container: f859ea6e2707d21bb9a2d585713fbc262629b2926f0d86453d28d76bf48fd811"}

When you abort the job you have a bunch of containers to clean up on both hosts as well as a failed job.

So, I'm not sure if this plugin only works with single docker hosts or it can be configured to a load balanced cluster (I prefer the latter).

Do you think this is a reasonable approach, or would you suggest that a YADP Cloud should only ever refer to a single docker host ?

I had some further thoughts about defining my docker hosts within a docker swarm cluster (since the swarm master know where all the containers are and should be able to route to them given a container or service id). However, in reading over the YADP issues log it appears that the plug-in doesn't support swarm mode (I haven't tried it yet but swarm's unit of deployment is a 'service' rather than an individual container).

Any thoughts much appreciated.

Regards

Fraser.

Not sure if this is an issue with this tutorial, jenkins, nginx or something I typed wrong somewhere.
Please let me know if this was an issue made in error.

I have to proxy due to some issues on my mac.

I have setup the Docker files according to the repo except with a port forward in the docker compose file to port 8080 -> 80 for nginx.

However when going to the credentials page the link seems to go to localhost not localhost:8080.
All other pages seem to work.

tutorial_07

Any instruction or blog post of how to generate the files under the certs folder?
There is no certs folder in the repo and no mention of how to generate the files under the folder

Step 33 : COPY certs/ca-key.pem /usr/local/etc/jenkins/certs/ca-key.pem
ERROR: Service 'master' failed to build: lstat certs/ca-key.pem: no such file or directory

Thanks

`Step 10/13 : RUN groupadd -g ${gid} ${group} && useradd -d "$JENKINS_HOME" -u ${uid} -g ${gid} -m -s /bin/bash ${user}
---> Running in b726674fd180
groupadd: option requires an argument -- 'g'
Usage: groupadd [options] GROUP

Options:
-f, --force exit successfully if the group already exists,
and cancel -g if the GID is already used
-g, --gid GID use GID for the new group
-h, --help display this help message and exit
-K, --key KEY=VALUE override /etc/login.defs defaults
-o, --non-unique allow to create groups with duplicate
(non-unique) GID
-p, --password PASSWORD use this encrypted password for the new group
-r, --system create a system account
-R, --root CHROOT_DIR directory to chroot into

The command '/bin/sh -c groupadd -g ${gid} ${group} && useradd -d "$JENKINS_HOME" -u ${uid} -g ${gid} -m -s /bin/bash ${user}' returned a non-zero code: 2`

Hi Max,

I know you are super busy and really hope you even just glimpse at my issue. I'm having issues with the Jenkins container. It's behind my NGINX proxy. I access it as you do on http://localhost:8080. After I log in I get kicked to http://localhost. Some links on Jenkins also does the same and removes the port which brakes the screen.

My NGINX conf file is like so...

server {
   listen       80;
   server_name  "";

   access_log off;

   location / {
       proxy_pass         http://jenkins_master_1:8080;

       proxy_set_header   Host             $host;
       proxy_set_header   X-Real-IP        $remote_addr;
       proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
       proxy_set_header   X-Forwarded-Proto http;
       proxy_max_temp_file_size 0;

       proxy_connect_timeout      150;
       proxy_send_timeout         100;
       proxy_read_timeout         100;

       proxy_buffer_size          8k;
       proxy_buffers              4 32k;
       proxy_busy_buffers_size    64k;
       proxy_temp_file_write_size 64k;    

   }

}

I've googled, tried adding a new listener to port 8080 like you mentioned on your tutorial. Trying to set this up to convince containers for work :/.

Thanks for any help you can!

Thanks,
Kieran

This error will come from the Jenkins Logs:

"Error in provisioning; template='DockerTemplate{configVersion=2, labelString='testslave', launcher=com.nirima.jenkins.plugins.docker.launcher.DockerComputerSSHLauncher@52deb96, remoteFsMapping='/home/jenkins', remoteFs='/home/jenkins', instanceCap=1, mode=EXCLUSIVE, retentionStrategy=com.nirima.jenkins.plugins.docker.strategy.DockerOnceRetentionStrategy@4e4e5b9e, numExecutors=1, dockerTemplateBase=DockerTemplateBase{image=jenkins_slave}, removeVolumes=false, pullStrategy=PULL_LATEST}' for cloud='Local Docker' com.github.dockerjava.api.BadRequestException: {"message":"starting container with HostConfig was deprecated since v1.10 and removed in v1.12"}"

It's due to an incompatibility in the Docker-Plugin. Figured I'd consolidate issues here where it's clear what the root cause is. I'll be working on testing fixes/updates based on the newer Docker Plugin, called "Yet Another Docker Plugin", very soon!

I'm new to Docker. I followed every single step. After running the docker-compose up, the jenkins_data and jenkins_slave container stopped in a few seconds after it starts.

Nginx and Jenkins master is running fine.

Is a strong error now:

Clicking in More Info button, i'm redirected to this page: https://wiki.jenkins-ci.org/display/JENKINS/Jenkins+says+my+reverse+proxy+setup+is+broken

Which the problem with the settings?

I'm using the basic configuration files from this repository. Thanks.

Hey,

Firstly, Brilliant tutorial! Good to get some insight.

Been struggling with the "SETUP DOCKER CERTIFICATE DIRECTORY" part from: https://engineering.riotgames.com/news/jenkins-ephemeral-docker-tutorial

Specifically: "Docker Certificates Directory" doesn't appear on the drop down list. Couldn't work out how to add the certificates with the new set of options on Jenkins (attached).

Any help in using the new Jenkins is greatly appreciated.

Kind Regards,

Ryan

Opening http://engineering.riotgames.com/news/building-jenkins-inside-ephemeral-docker-container

Returns "Error 403 - Access Denied"

I see that you implements a ip localization. It will be work very fine in windows and osx but in linux isn't needed.

I try to use my localhost ip but it doesn't works.

Which have to be docker ip address in a linux dev environment?

How can i run docker or even docker-compose inside of a slave?

Kind regards,
Max

See: https://wiki.jenkins-ci.org/display/JENKINS/Scriptler+Plugin

$CMD docker-compose build
failed for me 2016_09Sep_28.
I needed to update

jenkins-master/Dockerfile:ENV JAVA_VERSION 8u102
jenkins-master/Dockerfile:ENV JAVA_DEBIAN_VERSION 8u102-b14.1-1~bpo8+1

The readme says:

## Rebuild without blowing away local data

1. make stop
2. make clean
3. make build
4. make run

But the makefile doesn't content the clean target. It does clean-data and clean-images, so I suppose that make clean should be make clean-data.

Also:

## Rebuild AND blow away local data

1. make stop
2. make clean-data
3. make build
4. make run

That I suppose should be make clean-images instead of make clean-data.

Just info for Windows users. Cloning on Windows possibly saves plugins.sh (and other .sh) in Windows format. This produces "/bin/sh^M: bad interpreter: No such file or directory" error when build is started.
I've noticed this when using git clients (SourceTree).
Maybe install dos2unix ("yum install dos2unix") and "RUN dos2unix plugins.sh" after copying from dockerhost to container to prevent errors when editing these files on Windows (and saving in Windows format).
Or some script on dockerhost side..

http://stackoverflow.com/questions/14219092/bash-my-script-bin-bashm-bad-interpreter-no-such-file-or-directory

Hi, i made my own docker images and compose file and mounted all structure in my computer.

All is well.

But i have a warning in jenkins that say me the home partition is full:

Why happen this?

Reviewing this in your image, compling this repository, i foun a problem: I'd installed BlueOcean plugin, is heavy, and it ate the home space. But i can't understand this. We create a external data volume for avoid it, but this plugin eat all space, why?

Hi

Have you encountered this issue:
sed: can't read /var/jenkins_home/jenkins.model.JenkinsLocationConfiguration.xml: No such file or directory

after i start the docker container, getting this error?

Have you considered including an init.groovy.d/ script to automate the setup of docker-plugin? Going through the frontend is good for the tutorial, but it is tedious to perform those steps more than once.

The docker-plugin docs has a rough template for the setup script but it excludes the pull strategy and connect method; moreover it seems like the docs are still showing deprecated usage. I understand that configuring Jenkins falls outside the scope of your guide (which is excellent by the way, thank you), but including the groovy script will expose another important aspect of automating Jenkins. Do you find that reasoning sound?

Hi man, thanks for you grateful tutorial.

I have a question with the jenkins2 tutorial:

Create a new pipeline jenkins job
    Enter the following for the pipeline script:

node ('testslave') {

stage 'Stage 1'
sh 'echo "Hello World!"'

}

Save job
Run job

You put this, but, the script only can we put in a pipeline project, but, restringe a project ejecution to jenkins-slave volumen only we can configure in a free style project, where we can't use scripts, in this case which correct setup steps?

Since tutorial_01 does not have a tag like in other Dockerfiles it pulls the latest Jenkins version, which is 2.7.2 and crashes with the following error:

can@can: ~/dockerjenkins_tutorial/tutorial_01$ docker logs jenkins-master 
Running from: /usr/share/jenkins/jenkins.war
webroot: EnvVars.masterEnvVars.get("JENKINS_HOME")
Exception in thread "main" java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at Main._main(Main.java:246)
    at Main.main(Main.java:91)
Caused by: java.lang.IllegalArgumentException: Unrecognized option: --handlerCountStartup=100
    at winstone.cmdline.CmdLineParser.parse(CmdLineParser.java:53)
    at winstone.Launcher.getArgsFromCommandLine(Launcher.java:359)
    at winstone.Launcher.main(Launcher.java:332)

The latest version of Jenkins is not compatible with this tutorial, so the version should be specified for tutorial_01.

I changed the version of jenkins as the tutorial lists a very old version. However when changing the Jenkins_version number and the Jenkins_sha value it seems to not be able to start the docker container.

I had changed the values to 2.46.1 and the acumpaning sha256 (which I changed the sha check in the docker file to match)