ci(data-prepper): keep image layers on disposable build storage

services/logging/Jenkinsfile.data-prepper

@@ -2,7 +2,7 @@ pipeline {
   agent {
     kubernetes {
       // Keep build I/O off the node's runtime USB drive.
-      workspaceVolume dynamicPVC(accessModes: 'ReadWriteOnce', requestsSize: '20Gi', storageClassName: 'ci-scratch')
+      workspaceVolume dynamicPVC(accessModes: 'ReadWriteOnce', requestsSize: '40Gi', storageClassName: 'ci-scratch')
       yaml """
 apiVersion: v1
 kind: Pod
@@ -72,18 +72,45 @@ spec:
       command:
         - cat
       tty: true
-    - name: kaniko
-      image: gcr.io/kaniko-project/executor:v1.23.2-debug
-      command:
-        - /busybox/cat
-      tty: true
+    - name: dind
+      image: registry.bstein.dev/bstein/docker@sha256:90c332cc40ecd5e5acfab2145c855fcefec411926655a3e7530649a2cb876c5a
+      securityContext:
+        privileged: true
+      env:
+        - name: DOCKER_TLS_CERTDIR
+          value: ""
+      args:
+        - --mtu=1400
+        - --host=unix:///var/run/docker.sock
+        - --host=tcp://127.0.0.1:2375
+        - --tls=false
+      volumeMounts:
+        - name: workspace-volume
+          mountPath: /var/lib/docker
+          subPath: .cache/docker
       resources:
         requests:
-          cpu: "100m"
-          memory: "1Gi"
+          cpu: "75m"
+          memory: "512Mi"
         limits:
           cpu: "1500m"
           memory: "2Gi"
+    - name: docker-client
+      image: registry.bstein.dev/bstein/docker@sha256:90c332cc40ecd5e5acfab2145c855fcefec411926655a3e7530649a2cb876c5a
+      command: ["cat"]
+      tty: true
+      env:
+        - name: DOCKER_HOST
+          value: tcp://127.0.0.1:2375
+        - name: DOCKER_TLS_CERTDIR
+          value: ""
+      resources:
+        requests:
+          cpu: "25m"
+          memory: "128Mi"
+        limits:
+          cpu: "500m"
+          memory: "512Mi"
 """
     }
   }
@@ -460,7 +487,7 @@ EOF
     }
     stage('Build & Push') {
       steps {
-        container('kaniko') {
+        container('docker-client') {
           withCredentials([usernamePassword(credentialsId: 'harbor-robot-streaming', usernameVariable: 'HARBOR_USERNAME', passwordVariable: 'HARBOR_PASSWORD')]) {
             sh '''
               set -euo pipefail
@@ -469,27 +496,27 @@ EOF
               if [ -z "${HARBOR_REPO:-}" ] || [ "${HARBOR_REPO}" = "registry.bstein.dev/monitoring/data-prepper" ]; then
                 HARBOR_REPO="registry.bstein.dev/streaming/data-prepper"
               fi
-              mkdir -p /kaniko/.docker
-              ref_host="$(echo "${HARBOR_REPO}" | cut -d/ -f1)"
-              auth="$(printf "%s:%s" "${HARBOR_USERNAME}" "${HARBOR_PASSWORD}" | base64 | tr -d '\\n')"
-              cat > /kaniko/.docker/config.json <<EOF
-              {
-                "auths": {
-                  "${ref_host}": {
-                    "auth": "${auth}"
-                  }
-                }
-              }
-EOF
-              dest_args="--destination ${HARBOR_REPO}:${IMAGE_TAG}"
+              # Docker's layer store is the disposable PVC, not the node runtime.
+              set +x
+              attempt=0
+              until docker info >/dev/null 2>&1; do
+                attempt=$((attempt + 1))
+                [ "${attempt}" -lt 60 ] || exit 1
+                sleep 2
+              done
+              export DOCKER_CONFIG="$(mktemp -d "${TMPDIR}/docker-auth.XXXXXX")"
+              trap 'rm -rf "${DOCKER_CONFIG}"' EXIT
+              ref_host="${HARBOR_REPO%%/*}"
+              printf '%s' "${HARBOR_PASSWORD}" | docker login "${ref_host}" \
+                --username "${HARBOR_USERNAME}" --password-stdin >/dev/null
+              docker build --platform linux/arm64 --pull --progress=plain \
+                --file "${WORKSPACE}/dockerfiles/Dockerfile.data-prepper" \
+                --tag "${HARBOR_REPO}:${IMAGE_TAG}" "${WORKSPACE}"
+              docker push "${HARBOR_REPO}:${IMAGE_TAG}"
               if [ "${PUSH_LATEST}" = "true" ]; then
-                dest_args="${dest_args} --destination ${HARBOR_REPO}:latest"
+                docker tag "${HARBOR_REPO}:${IMAGE_TAG}" "${HARBOR_REPO}:latest"
+                docker push "${HARBOR_REPO}:latest"
               fi
-              /kaniko/executor \
-                --context "${WORKSPACE}" \
-                --dockerfile "${WORKSPACE}/dockerfiles/Dockerfile.data-prepper" \
-                --verbosity info \
-                ${dest_args}
             '''
           }
         }