[P9] Add WOODPECKER_PLUGINS_PRIVILEGED for buildx and trivy #99

New Issue

kert · 2026-03-22T14:37:47Z

kert commented

2026-03-22 14:37:47 +00:00

Problem

Woodpecker v3.x changed the default privilege model: woodpeckerci/plugin-docker-buildx (and likely plugin-trivy) are no longer privileged by default. All image build and scan steps fail with a privilege error.

Affected pipelines

deploy.yml — 5 buildx + 4 trivy steps
infra-ci.yml — 5 buildx steps (dry_run)
rebuild-all.yml — 5 buildx + 3 trivy steps

Fix

Add WOODPECKER_PLUGINS_PRIVILEGED to the woodpecker-server environment in compose.yml:

- WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-trivy

This is a server-side setting — the server must whitelist plugins that are allowed to run privileged. The agent already runs with privileged: true.

Acceptance criteria

WOODPECKER_PLUGINS_PRIVILEGED added to woodpecker-server env
docker compose up -d woodpecker-server restarts cleanly
Trigger rebuild-all.yml manually and confirm all buildx steps pass

## Problem Woodpecker v3.x changed the default privilege model: `woodpeckerci/plugin-docker-buildx` (and likely `plugin-trivy`) are no longer privileged by default. All image build and scan steps fail with a privilege error. ## Affected pipelines - `deploy.yml` — 5 buildx + 4 trivy steps - `infra-ci.yml` — 5 buildx steps (dry_run) - `rebuild-all.yml` — 5 buildx + 3 trivy steps ## Fix Add `WOODPECKER_PLUGINS_PRIVILEGED` to the **woodpecker-server** environment in `compose.yml`: ```yaml - WOODPECKER_PLUGINS_PRIVILEGED=woodpeckerci/plugin-docker-buildx,woodpeckerci/plugin-trivy ``` This is a server-side setting — the server must whitelist plugins that are allowed to run privileged. The agent already runs with `privileged: true`. ## Acceptance criteria - [ ] `WOODPECKER_PLUGINS_PRIVILEGED` added to woodpecker-server env - [ ] `docker compose up -d woodpecker-server` restarts cleanly - [ ] Trigger `rebuild-all.yml` manually and confirm all buildx steps pass

kert added this to the P9: CI/CD Unification milestone 2026-03-22 14:37:47 +00:00

kert added the ci label 2026-03-22 14:37:47 +00:00

kert referenced this issue

2026-03-22 14:38:14 +00:00

[P9] Audit pipeline volume mounts after privilege model change #100

kert referenced this issue from a commit

2026-03-22 14:41:09 +00:00

whitelist buildx and trivy as privileged woodpecker plugins

kert closed this issue

2026-03-22 14:41:09 +00:00

Sign in to join this conversation.