Introduce better security for buildpacks-phases task

task/buildpacks-phases/0.1/README.md

@@ -5,6 +5,8 @@ Buildpacks](https://buildpacks.io). To do that, it uses [builders](https://build
 
 Cloud Native Buildpacks are pluggable, modular tools that transform application source code into OCI images. They replace Dockerfiles in the app development lifecycle, and enable for swift rebasing of images and modular control over images (through the use of builders), among other benefits. This command uses a builder to construct the image, and pushes it to the registry provided.
 
+The lifecycle phases are run in separate containers to enable better security for untrusted builders. Specifically, registry credentials are hidden from the detect and build phases of the lifecycle, and the analyze, restore, and export phases (which require credentials) are run in the lifecycle image published by the [Cloud Native Buildpacks project]( https://hub.docker.com/u/buildpacksio).
+
 See also [`buildpacks`](../buildpacks) for the combined version of this task, which uses the [creator binary](https://github.com/buildpacks/spec/blob/platform/0.3/platform.md#operations), to run all of the [lifecycle phases](https://buildpacks.io/docs/concepts/components/lifecycle/#phases). This task, in contrast, runs all of the phases separately.
 
 ## Install the Task

task/buildpacks-phases/0.1/buildpacks-phases.yaml

@@ -57,6 +57,7 @@ spec:
         value: "0.3"
 
   steps:
+    # Ensure the builder's user has read/write permissions for needed directories.
     - name: prepare
       image: alpine
       imagePullPolicy: Always
@@ -76,6 +77,19 @@ spec:
       securityContext:
         privileged: true
 
+    # Copy stack.toml so that it will be accessible to the exporter, since the lifecycle image will not contain it.
+    - name: copy-stack-toml
+      image: $(params.BUILDER_IMAGE)
+      imagePullPolicy: Always
+      command: ["/bin/sh"]
+      args:
+        - "-c"
+        - >
+          cp /cnb/stack.toml /layers/
+      volumeMounts:
+        - name: layers-dir
+          mountPath: /layers
+
     - name: detect
       image: $(params.BUILDER_IMAGE)
       imagePullPolicy: Always
@@ -89,15 +103,19 @@ spec:
           mountPath: /layers
         - name: $(params.PLATFORM_DIR)
           mountPath: /platform
+        - name: empty-dir
+          mountPath: /tekton/home
 
     - name: analyze
-      image: $(params.BUILDER_IMAGE)
+      image: buildpacksio/lifecycle:0.8.1
       imagePullPolicy: Always
       command: ["/cnb/lifecycle/analyzer"]
       args:
         - "-layers=/layers"
         - "-group=/layers/group.toml"
         - "-cache-dir=/cache"
+        - "-uid=$(params.USER_ID)"
+        - "-gid=$(params.GROUP_ID)"
         - "$(resources.outputs.image.url)"
       volumeMounts:
         - name: $(params.CACHE)
@@ -106,13 +124,15 @@ spec:
           mountPath: /layers
 
     - name: restore
-      image: $(params.BUILDER_IMAGE)
+      image: buildpacksio/lifecycle:0.8.1
       imagePullPolicy: Always
       command: ["/cnb/lifecycle/restorer"]
       args:
         - "-group=/layers/group.toml"
         - "-layers=/layers"
         - "-cache-dir=/cache"
+        - "-uid=$(params.USER_ID)"
+        - "-gid=$(params.GROUP_ID)"
       volumeMounts:
         - name: $(params.CACHE)
           mountPath: /cache
@@ -133,9 +153,11 @@ spec:
           mountPath: /layers
         - name: $(params.PLATFORM_DIR)
           mountPath: /platform
+        - name: empty-dir
+          mountPath: /tekton/home
 
     - name: export
-      image: $(params.BUILDER_IMAGE)
+      image: buildpacksio/lifecycle:0.8.1
       imagePullPolicy: Always
       command: ["/cnb/lifecycle/exporter"]
       args:
@@ -144,6 +166,9 @@ spec:
         - "-group=/layers/group.toml"
         - "-cache-dir=/cache"
         - "-process-type=$(params.PROCESS_TYPE)"
+        - "-uid=$(params.USER_ID)"
+        - "-gid=$(params.GROUP_ID)"
+        - "-stack=/layers/stack.toml"
         - "$(resources.outputs.image.url)"
       volumeMounts:
         - name: layers-dir