Bamboo does not clean up orphaned processes - security issue

[Johannes A]

Hi all,

On both windows and linux agents and the latest version of Bamboo, it is very simple to detach a process from the parent bamboo build process, so that it continues to run after the build returns.

One can observe this for example with gradle builds, whereby the gradle deamon will stay running on the agent in the background. Windows generally launches processes in a detached mode, so if a build plan does a "Start-Process notepad", the notepad will stay open after the build returns. Same for linux. Very easy to detach, e.g. a sleep command with /bin/bash -c 'sleep 60  > /dev/null 2>&1 &'.

While this can be a stability issue for agents, it is a pretty sever security issue. A rogue process running on the remote agent can spy on anything that a subsequent build plan is executing. This may be passwords (even if passed by the plan as "password/secret variables", these values are stored as simple environment variables on the remote agent while a build is executing), or confidential source code in the build directory, just to name two prominent candidates.

I wonder how other companies are dealing with this problem? Has anyone found a good solution / written a plugin that takes care of the cleanup in a reliable way? Or are you opting for completely different architectures like "disposable" agents (run agents as containers and re-instantiate after each build)? 

Atlassian Bamboo team, is this on your radar? What is your take on this? We investigated the same behavior in VSTS, which is reliably cleaning up orphan processes after the build. Not sure about other CI/CD platforms.

Thanks

[Omar Herrera]

Hi @Johannes A, I think the future is run agents as containers, in bamboo you are ready to run build process in docker support is a perfect way to  isolated each build.

Cheers.

Omar H.