Hermetic Execution Mode
A Hermetic Build is a release engineering best practice for increasing the reliability and consistency of software builds. They are self-contained, and do not depend on anything outside of the build environment. This means they do not have network access, and cannot fetch dependencies at runtime.
When hermetic execution mode is enabled, all TaskRun steps will be run without access to a network. Note: hermetic execution mode does NOT apply to sidecar containers
Hermetic execution mode is currently an alpha experimental feature.
Enabling Hermetic Execution Mode
To enable hermetic execution mode:
- Make sure
enable-api-fieldsis set to
- Set the following annotation on any TaskRun you want to run hermetically:
Sample Hermetic TaskRun
This example TaskRun demonstrates running a container in a hermetic environment.
The Step attempts to install curl, but this step SHOULD FAIL if the hermetic environment is working as expected.
kind: TaskRun apiVersion: tekton.dev/v1beta1 metadata: generateName: hermetic-should-fail annotations: experimental.tekton.dev/execution-mode: hermetic spec: timeout: 60s taskSpec: steps: - name: hermetic image: ubuntu script: | #!/usr/bin/env bash apt-get update apt-get install -y curl
To learn more about hermetic execution mode, check out the TEP.
Was this page helpful?