Code

Don't run docker containers as root#400

Code

Open

jeremyestein wants to merge 81 commits intomainSAFEHR-data/PIXL:mainfrom jeremy/docker-uid-newSAFEHR-data/PIXL:jeremy/docker-uid-newCopy head branch name to clipboard

+311-262

Commits

Commits on May 8, 2024

• Make packages easier to read

  jeremyestein

  committed
  93e99d5

• Remove unneeded packages

  jeremyestein

  committed
  4b1f8fa

• Merge three pixl python docker images into one multi-stage dockerfile to

  Show description for d087520
  jeremyestein

  committed
  d087520

• Specify healthcheck command in only one place

  jeremyestein

  committed
  1e1c18e

• De-dupe the pre-reqs installation code using a build arg

  jeremyestein

  committed
  63d6edb

• De-dupe the actual install as well

  jeremyestein

  committed
  46a08e0

• Add (failing) test for the condition we are aiming for: containers to

  Show description for 64fcbc5
  jeremyestein

  committed
  64fcbc5

Commits on May 9, 2024

• Run as user pixl, which we have to create inside the image with a

  Show description for 0d5cb39
  jeremyestein

  committed
  0d5cb39

• The system test already builds the required docker images, and passes

  Show description for 397cb68
  jeremyestein

  committed
  397cb68

• Semi-WIP: Create pixl user+group on the GHA test runner so that we can set file

  Show description for d7fa46e
  jeremyestein

  committed
  d7fa46e

• Fix variable usage and exports dir location

  jeremyestein

  committed
  d8525b1

• More debugging

  jeremyestein

  committed
  6facef9

• debug

  jeremyestein

  committed
  55db93c

• debug

  jeremyestein

  committed
  6f7c8dd

• split build and up

  jeremyestein

  committed
  0ff9148

• Create user home dir in the GHA script to avoid error from failed

  Show description for cce26a5
  jeremyestein

  committed
  cce26a5

• Why is pytest not found? Some kind of env change caused by sudo?

  jeremyestein

  committed
  1e3ed88

• Preserve path when running sudo

  jeremyestein

  committed
  8abcb5f

• Run tests as normal runner user

  jeremyestein

  committed
  de4e1e9

• Don't see why this needs to have docker group

  jeremyestein

  committed
  5736f30

• Debugging for perm failure on file deletes

  jeremyestein

  committed
  09f37ea

• Fix scope error

  jeremyestein

  committed
  0edcf17

• OK maybe this was needed after all

  jeremyestein

  committed
  d0201d8

• Since CLI creates everything in exports dir these days, it makes more

  Show description for 077a304
  jeremyestein

  committed
  077a304

• Try not creating home dir for pixl - what is even using this?

  jeremyestein

  committed
  cd93adc

• and therefore I can't do this any more

  jeremyestein

  committed
  c0c0d96

Commits on May 10, 2024

• Remove debugging

  jeremyestein

  committed
  9507816

• Document the reason for the permissions setup better. Don't need to

  Show description for bd5cf84
  jeremyestein

  committed
  bd5cf84

• If Export API is believed to only read from the export dir, then let's

  Show description for de2ea9d
  jeremyestein

  committed
  de2ea9d

• First attempt at documentation on docker permissions.

  jeremyestein

  committed
  9aaf2c7

• CLI user needs to be able to write to export dir.

  jeremyestein

  committed
  0bd75fb

• Clarify docs

  jeremyestein

  committed
  db201d9

Commits on May 15, 2024

• Go with the assumption that the host machine will have a "pixl" user and

  Show description for 928a092
  jeremyestein

  committed
  928a092

• oops left in empty arg

  jeremyestein

  committed
  e13fe01

• Set the setgid bit so that subdirs/files in exports will be owned by the

  Show description for 017a0a9
  jeremyestein

  committed
  017a0a9

• debugging

  jeremyestein

  committed
  9eb831b

• fix debugging

  jeremyestein

  committed
  8e9771b

• doesn't exist?

  jeremyestein

  committed
  15b98c8

• Make debugging more useful and permanent. More docs

  jeremyestein

  committed
  572144d

• more debugging

  jeremyestein

  committed
  2d7c902

• Set the FACL

  jeremyestein

  committed
  cf1900e

• usermod doesn't change groups of existing shells. Need to run the system

  Show description for eb5da97
  jeremyestein

  committed
  eb5da97

• Invoking a new shell with "bash" doesn't re-read groups, but using sudo

  Show description for 995b35b
  jeremyestein

  committed
  995b35b

• Need to preserve envs

  jeremyestein

  committed
  303374c

• more debugging

  jeremyestein

  committed
  edde878

• Unlikely to work because su will prompt

  jeremyestein

  committed
  ef1b113

• Will just passing PATH be enough?

  jeremyestein

  committed
  806449d

• Pass through all env as well as PATH

  jeremyestein

  committed
  629a5e4

• Remove debugging

  jeremyestein

  committed
  8bbe273

Commits on May 20, 2024

• Merge branch 'main' into jeremy/docker-uid-new

  jeremyestein

  authored
  b9edf54

Commits on May 21, 2024

• Merge branch 'main' into jeremy/docker-uid-new

  jeremyestein

  authored
  d167c13

Commits on May 22, 2024

• Unite orthanc Dockerfiles

  jeremyestein

  committed
  4c6f6d1

• Add orthanc containers to test

  jeremyestein

  committed
  1b46c83

• Make orthanc run as orthanc user instead of root

  jeremyestein

  committed
  468d908

• Can also use non-root for fakes in system test

  jeremyestein

  committed
  1004681

• Non-root orthanc works for core and imaging tests too

  jeremyestein

  committed
  668ebc0

• Add fakes to system test container user check

  jeremyestein

  committed
  695f64f

• Remove debugging

  jeremyestein

  committed
  b34abbc

• Use same orthanc version everywhere

  jeremyestein

  committed
  02e3b79

• Use existing YAML anchors

  jeremyestein

  committed
  420fb7f

• Don't think this is needed since we moved this code to the export-api

  jeremyestein

  committed
  b4d2526

Commits on Jun 14, 2024

• Try adding orthanc to PIXL group

  stefpiatek

  committed
  cca7b93

• Try adding orthanc to PIXL group

  stefpiatek

  committed
  5925520

• Try adding orthanc to PIXL group

  stefpiatek

  committed
  3437005

• Try adding orthanc to PIXL group

  stefpiatek

  committed
  905e741

• Change owner of pixl file

  stefpiatek

  committed
  19be6c7

• Try setting pixl user before copying

  stefpiatek

  committed
  4c39072

• Change owner of python projects on copy

  stefpiatek

  committed
  32ca6bb

• Change owner of python projects on copy

  stefpiatek

  committed
  81eabb7

• Change owner of python projects on copy

  stefpiatek

  committed
  21ccb13

• Merge branch 'main' into jeremy/docker-uid-new

  stefpiatek

  authored
  9ef77e7

• Define wait for images to be exported in conftest

  stefpiatek

  committed
  ee1b97c

• Add group ID to test build args

  stefpiatek

  committed
  47822a9

Commits on Jul 4, 2024

• Merge branch 'main' into jeremy/docker-uid-new

  milanmlft

  authored
  242aacf

Commits on Jul 18, 2024

• Update README.md

  Show description for 6e945c3
  

  stefpiatek

  and

  milanmlft

  authored
  6e945c3

Commits on Jul 30, 2024

• Merge branch 'main' into jeremy/docker-uid-new

  milanmlft

  committed
  c7b2711

• Consolidate RUN commands

  Show description for 521b1cd
  milanmlft

  committed
  521b1cd

• Merge branch 'main' into jeremy/docker-uid-new

  stefpiatek

  authored
  653a921

Commits on Jul 31, 2024

• Add @dram1964's instructions for setting up a PIXL user on GAE

  milanmlft

  authored
  5d1937d

Commits on Oct 7, 2024

• Merge remote-tracking branch 'origin/main' into jeremy/docker-uid-new

  Show description for b8a6de5
  stefpiatek

  committed
  b8a6de5

• Merge remote-tracking branch 'origin/main' into jeremy/docker-uid-new

  Show description for 75af526
  stefpiatek

  committed
  75af526