Hermekton Beta Tracking Issue

[priyawadhwa]

This is an overarching issue we can use to track the different things we'll need to do for hermekton beta:

• Figure out how we want to handle sidecar containers. We can either just document that they aren't supported or actually fail if hermetic execution mode is applied on a Task with sidecar containers
• Add sample working tasks & pipelines
• Should they be enabled for pipelines as well?
• Make sure hermekton works if the user isn't running as root (more details in Add support for experimental hermetic execution mode to TaskRuns #3956 (comment)) (added test for this in Add hermetic test running as non-root user #3973 )
• Check if this will work across most major kernel versions (namespaces introduced in 2013, so we should be good here)
• Documentation on limitations/generally make sure docs are up to date
• Remove the alpha feature flag requirement for hermekton

Relevant Links:
TEP: https://github.com/tektoncd/community/blob/main/teps/0025-hermekton.md
Hermekton alpha PR: #3956

[imjasonh]

Figure out how we want to handle sidecar containers. We can either just document that they aren't supported or actually fail if hermetic execution mode is applied on a Task with sidecar containers

One option, at least for declared sidecars, would be to inject the entrypoint even if we don't otherwise use it to start the container. That wouldn't help with injected sidecars, but then we could just detect/block injected sidecars, instead of blocking all sidecars.

[priyawadhwa]

@imjasonh wouldn't we have to use the entrypointer to start the container as well? Right now hermekton basically takes the command the entrypointer would run and runs it in a namespace without network access, so I think we'd need the entrypointer to start sidecars as well for this to work--

pipeline/cmd/entrypoint/runner.go

Line 63 in 145043a

dropNetworking(cmd)

[tekton-robot]

Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale with a justification.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close with a justification.
If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[vdemeester]

/lifecycle frozen