Add ECR credential provider

[yuzhouliu9]

Adds the amazon-ecr-credential-helper to the container image.
ECR access-key and secret-key will be set as environment variables, and the credential helper will do the work when executing any buildah command. buildah login is not needed.

Testing

I spun up minikube to have a working registry.example.com

make local-push

docker run --rm --security-opt seccomp=/Users/yuzhou.liu/Downloads/work/buildah/seccomp.json --rm -e PLUGIN_MANIFEST="{\"sources\":[\"a\"],\"targets\":[\"1\"]}" -e PLUGIN_ACCESS_KEY="public_ecr_key" -e PLUGIN_SECRET_KEY="public_ecr_secret" -e PLUGIN_REGISTRY="public.ecr.aws" registry.example.com/buildah-plugin:latest

The seccomp.json is from here and is needed for docker because of this

Alternatively, testing with podman, you don't need seccomp.json

podman run --rm -e PLUGIN_MANIFEST="{\"sources\":[\"a\"],\"targets\":[\"1\"]}" -e PLUGIN_ACCESS_KEY="public_ecr_key" -e PLUGIN_SECRET_KEY="public_ecr_secret" -e PLUGIN_REGISTRY="public.ecr.aws" registry.example.com/buildah-plugin:latest

I'll post more details on how to test in slack

[dskatz]

An easier way to test this I think would be to adjust the drone pipeline to push a git-hash image to our registry. Then we can use the buildah-plugin within drone as normal.

[yuzhouliu9]

An easier way to test this I think would be to adjust the drone pipeline to push a git-hash image to our registry. Then we can use the buildah-plugin within drone as normal.

It was already doing this but only for pushes to main branch. I've changed it now to trigger publish git-hash image for all branches.

[whwalter]

We don't need to manage HOME and these permissions would be bad anyway.

/home/build already exists for the build user and /home/app exists for the app user so just consume the default home of whichever user we settle on.

[yuzhouliu9]

Oh thanks, I didn't bother looking at the upstream quay.io/buildah/stable Containerfile till now. Good catch.

Updated to use USER build because it seems the reference image already sets up all the necessary permissions subuid, subgid for that user so we don't need to repeat for another user.