Force root in Kubernetes runs (#1555)

dstackai · Aug 15, 2024 · 64c80ca · 64c80ca
1 parent 951d362
commit 64c80ca
Show file tree

Hide file tree

Showing 2 changed files with 7 additions and 0 deletions.
diff --git a/src/dstack/_internal/core/backends/base/compute.py b/src/dstack/_internal/core/backends/base/compute.py
@@ -253,6 +253,8 @@ def get_docker_commands(
 ) -> List[str]:
     authorized_keys_content = "\n".join(authorized_keys).strip()
     commands = [
+        # TODO(#1535): support non-root images properly
+        "mkdir -p /root && chown root:root /root && export HOME=/root",
         # note: &> redirection doesn't work in /bin/sh
         # check in sshd is here, install if not
         "if ! command -v sshd >/dev/null 2>&1; then apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y openssh-server || yum install -y openssh-server; fi",

diff --git a/src/dstack/_internal/core/backends/kubernetes/compute.py b/src/dstack/_internal/core/backends/kubernetes/compute.py
@@ -152,6 +152,11 @@ def run_job(
                                     container_port=RUNNER_SSH_PORT,
                                 )
                             ],
+                            security_context=client.V1SecurityContext(
+                                # TODO(#1535): support non-root images properly
+                                run_as_user=0,
+                                run_as_group=0,
+                            ),
                             # TODO: Pass cpu, memory, gpu as requests.
                             # Beware that node capacity != allocatable, so
                             # if the node has 2xCPU – then cpu=2 request will probably fail.