fix(lib-inject): allow all users to read and modify installed packages [backport #6569 to 1.17]

.github/workflows/lib-injection.yml

@@ -77,6 +77,13 @@ jobs:
           # Wait for the app to start
           sleep 60
           docker-compose logs
+      - name: Check Permissions on ddtrace pkgs
+        run: |
+           cd lib-injection
+           # Ensure /datadog-lib/ddtrace_pkgs is a valid directory that is not empty
+           docker-compose run lib_inject find /datadog-init/ddtrace_pkgs -maxdepth 0 -empty | wc -l && if [ $? -ne 0 ]; then exit 1; fi
+           # Ensure non-datadog users have read and write permissions to files stored in /datadog-lib/ddtrace_pkgs
+           docker-compose run lib_inject find /datadog-init/ddtrace_pkgs ! -perm -a=rw | wc -l && if [ $? -ne 0 ]; then exit 1; fi
       - name: Test the app
         run: |
           curl http://localhost:18080

docs/spelling_wordlist.txt

@@ -104,6 +104,7 @@ https
 httpx
 iPython
 ini
+InitContainer
 initializer
 integration
 integrations

lib-injection/Dockerfile

@@ -29,6 +29,7 @@ ARG UID=10000
 RUN addgroup -g 10000 -S datadog && \
     adduser -u ${UID} -S datadog -G datadog
 RUN chown -R datadog:datadog /datadog-init/ddtrace_pkgs
+RUN chmod -R a+rw /datadog-init/ddtrace_pkgs
 USER ${UID}
 WORKDIR /datadog-init
 ADD sitecustomize.py /datadog-init/sitecustomize.py

releasenotes/notes/lib-injection-pkg-dir-permissions-aaac0059b6c21f30.yaml

@@ -0,0 +1,4 @@
+---
+fixes:
+  - |
+    lib-injection: Resolves permissions errors raised when ddtrace packages are copied from the InitContainer to the shared volume.