Clean up workspace dir from inside runner to avoid permission errors. #1648
+30
−9
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
smoser
force-pushed
the
fix/cleanup-inside
branch
from
92b1464
to
255010f
Compare
When running privileged docker as an unprivileged user, the files that are created in the WorkspaceDir are created as root. Even if the build were run as non-root, they would not necessarily be the same ownership as the user invoking melange. As a result, WorkspaceDir would not be able to be cleaned up and melange would just leave files there to later be cleaned up with a dangerous 'sudo rm -Rf' by the user. The change here is to clean up the WorkspaceDir from _inside_ the container, where the uid is the same as the uid that created the files. I believe this will waste IO and/or time on the qemu runner, where /home/build isn't actually bind'd in. Later we could expose a CleanWorkspace from the runner that was a noop in qemu. Signed-off-by: Scott Moser <[email protected]>
smoser
force-pushed
the
fix/cleanup-inside
branch
from
255010f
to
beaef88
Compare
|
I like this 👍 related to #1647 we could move also the mkdir in the container this way? This should fix the problem of subpackage building when using docker runner with an unprivileged user
Also nice yes |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
When running privileged docker as an unprivileged user, the files that are created in the WorkspaceDir are created as root. Even if the build were run as non-root, they would not necessarily be the same ownership as the user invoking melange.
As a result, WorkspaceDir would not be able to be cleaned up and melange would just leave files there to later be cleaned up with a dangerous 'sudo rm -Rf' by the user.
The change here is to clean up the WorkspaceDir from inside the container, where the uid is the same as the uid that created the files.
I believe this will waste IO and/or time on the qemu runner, where /home/build isn't actually bind'd in. Later we could expose a CleanWorkspace from the runner that was a noop in qemu.