Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Set UID and GID for github generated docker images #509

Merged
merged 1 commit into from
Dec 13, 2024

Conversation

cmickeyb
Copy link
Contributor

Explicitly set the user and group ids for images that will be pushed ghcr by the docker workflow. This makes it easier to manage permissions of the xfer directory when using images from the registry.

Explicitly set the user and group ids for images that will
be pushed ghcr by the docker workflow. This makes it easier
to manage permissions of the xfer directory when using images
from the registry.

Signed-off-by: Mic Bowman <mic.bowman@intel.com>
@cmickeyb cmickeyb requested a review from g2flyer December 12, 2024 21:48
@cmickeyb cmickeyb self-assigned this Dec 12, 2024
# file management with pulled images. Specifically, the
# following will make the xfer directory writeable by the
# images:
# sudo chown -R 55172:55172 $PDO_SOURCE_ROOT/docker/xfer
Copy link
Contributor

@g2flyer g2flyer Dec 12, 2024

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

hmm, isn't just changing group (chgrp -R pdo_group $PDO_SOURCE_ROOT/docker/xfer) the only thing you need (and if you are in that group wouldn't need sudo)?

But you also would have to make sure it is group writeable Unfortunately it doesn't seem there is an easy way to define a specific umask for both build and run. Probably easiest just do chmod -R g+w at end? Or could pre-set sticky bits on the directory come to the rescue? as long as we do not create new directories during build (as currently), not having group-write on the created files is actually at least as far as make clean goes. The only case i could somewhat see as problematic is if user has umask 077 and you want to read files? But then i guess nowadays this umask is not very common and probably the scenario neither ...

Also the actual user running should be in that new group? (i.e., you might also want to add the convenience comments on the sudo groupadd pdo_group and sudo usermod $(USER) -a -G pdo_group?)

Also, why not even add a make command to do these changes? And i guess there should ideally also be a docu-update?

@g2flyer
Copy link
Contributor

g2flyer commented Dec 13, 2024

FYI: could get it working as follows:

# - setup once
sudo groupadd pdo_
sudo usermod $(USER) -a -G pdo_group
# create new login shell to acquire new group
chgrp -Rvb pdo_group $PDO_SOURCE_ROOT/docker/xfer

# - test which then worked ..
make -C docker PDO_USER_UID=55172 PDO_GROUP_UID=55172 clean
make -C docker PDO_USER_UID=55172 PDO_GROUP_UID=55172
make -C docker PDO_USER_UID=55172 PDO_GROUP_UID=55172 test_no_reset
make -C docker PDO_USER_UID=55172 PDO_GROUP_UID=55172 clean

# - FYI docker build warnings i got ..
 X warnings found (use docker --debug to expand):
 - InvalidDefaultArgInFrom: Default value for ARG pdo_services_base:${PDO_VERSION} results in empty or invalid base image name (line 23)
 - LegacyKeyValueFormat: "ENV key=value" should be used instead of legacy "ENV key value" format (line 31)

@cmickeyb cmickeyb merged commit b89e3b6 into hyperledger-labs:main Dec 13, 2024
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants