Enable execution of steps within Ephemeral Containers.
Ephemeral containers are added to the build agent Pod using the withEphemeralContainer step. The newly
created container will share the same workspace volume and network
as other containers in the Pod and so behave similar to the container
step. The difference is withEphemeralContainer will terminated the container when the withEphemeralContainer block exits.
podTemplate {
node(POD_LABEL) {
stage('Build a Maven project') {
git 'https://github.com/jenkinsci/kubernetes-plugin.git'
withEphemeralContainer(image: 'maven') {
sh 'mvn -B -ntp clean package -DskipTests'
}
}
stage('Build a Golang project') {
git url: 'https://github.com/hashicorp/terraform.git', branch: 'main'
withEphemeralContainer(image: 'golang') {
sh '''
mkdir -p /go/src/github.com/hashicorp
ln -s `pwd` /go/src/github.com/hashicorp/terraform
cd /go/src/github.com/hashicorp/terraform && make
'''
}
}
}
}
The Ephemeral Container spec does not allow for specifying resources, but will still be subject to the Pod overall resource limits. The kubelet may evict a Pod if an ephemeral container causes the Pod to exceed its resource allocation. To avoid eviction it is advisable to increase the limits of the primary container to account for potential ephemeral container resource requirements.
In Kubernetes, the size limit for objects stored in etcd, including pod specs, is 1.5MB per key-value pair.
This means there is a finite number of ephemeral containers that may be added to a build agent. This is usually
not much of an issue for most pipelines, but could become an issue for long-running Pods. For this reason
it is not recommended to re-use agent nodes for multiple builds. Setting the Pod Template idle minutes property
("Time in minutes to retain agent when idle") to 0 is a good practice.
Because pipelines are able to run arbitrary images, some clouds may choose to disable this feature or limit
the allowed images (i.e. Container Image Rule) for security reasons.
When enabled the build environment variable KUBERNETES_CLOUD_EPHEMERAL_CONTAINERS_ENABLED=true will be
added to signal to pipeline scripts the withEphemeralContainer step is available for use.