Skip to content

Commit 6944478

Browse files
glehmannglehmann
committed
Don't include the uid/gid of the final user in the image
This way the image is usable by everybody, independantly of its ids. With docker, we modify the builder user in the entrypoint to match the uid:gid of the user launching the container, and then continue with the builder user thanks to gosu. With podman we use the `--userns` option to map the builder user to the user on the system. I haven't found a way with podman to use the same mechanism as in docker, and vis versa. Signed-off-by: Gaëtan Lehmann <[email protected]>
1 parent d326fd2 commit 6944478

File tree

6 files changed

+56
-78
lines changed

6 files changed

+56
-78
lines changed

‎Dockerfile-7.x‎

Lines changed: 11 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@ ARG CENTOS_VERSION=7.2.1511
22

33
FROM centos:${CENTOS_VERSION}
44

5-
ARG CUSTOM_BUILDER_UID=""
6-
ARG CUSTOM_BUILDER_GID=""
7-
85
# Remove all repositories
96
RUN rm /etc/yum.repos.d/*
107

@@ -55,24 +52,18 @@ RUN yum clean all
5552
# OCaml in XS is slightly older than in CentOS
5653
RUN sed -i "/gpgkey/a exclude=ocaml*" /etc/yum.repos.d/Cent* /etc/yum.repos.d/epel*
5754

58-
# Set up the builder user
59-
RUN bash -c ' \
60-
OPTS=(); \
61-
if [ -n "${CUSTOM_BUILDER_UID}" ]; then \
62-
OPTS+=("-u" "${CUSTOM_BUILDER_UID}"); \
63-
fi; \
64-
if [ -n "${CUSTOM_BUILDER_GID}" ]; then \
65-
OPTS+=("-g" "${CUSTOM_BUILDER_GID}"); \
66-
if ! getent group "${CUSTOM_BUILDER_GID}" >/dev/null; then \
67-
groupadd -g "${CUSTOM_BUILDER_GID}" builder; \
68-
fi; \
69-
fi; \
70-
useradd "${OPTS[@]}" builder; \
71-
' \
55+
# create the builder user
56+
RUN groupadd -g 1000 builder \
57+
&& useradd -u 1000 -g 1000 builder \
7258
&& echo "builder:builder" | chpasswd \
73-
&& echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers \
74-
&& usermod -G mock builder
59+
&& echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
7560

7661
RUN mkdir -p /usr/local/bin
62+
RUN curl -fsSL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" -o /usr/local/bin/gosu \
63+
&& chmod +x /usr/local/bin/gosu
7764
COPY files/init-container.sh /usr/local/bin/init-container.sh
78-
COPY files/rpmmacros /home/builder/.rpmmacros
65+
COPY files/entrypoint.sh /usr/local/bin/entrypoint.sh
66+
COPY --chown=builder:builder files/rpmmacros /home/builder/.rpmmacros
67+
68+
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
69+
CMD ["bash"]

‎Dockerfile-8.x‎

Lines changed: 10 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,6 @@ ARG CENTOS_VERSION=7.5.1804
22

33
FROM centos:${CENTOS_VERSION}
44

5-
ARG CUSTOM_BUILDER_UID=""
6-
ARG CUSTOM_BUILDER_GID=""
7-
85
# Remove all repositories
96
RUN rm /etc/yum.repos.d/*
107

@@ -58,23 +55,18 @@ RUN yum clean all
5855
# OCaml in XS may be older than in CentOS
5956
RUN sed -i "/gpgkey/a exclude=ocaml*" /etc/yum.repos.d/Cent* /etc/yum.repos.d/epel*
6057

61-
# Set up the builder user
62-
RUN bash -c ' \
63-
OPTS=(); \
64-
if [ -n "${CUSTOM_BUILDER_UID}" ]; then \
65-
OPTS+=("-u" "${CUSTOM_BUILDER_UID}"); \
66-
fi; \
67-
if [ -n "${CUSTOM_BUILDER_GID}" ]; then \
68-
OPTS+=("-g" "${CUSTOM_BUILDER_GID}"); \
69-
if ! getent group "${CUSTOM_BUILDER_GID}" >/dev/null; then \
70-
groupadd -g "${CUSTOM_BUILDER_GID}" builder; \
71-
fi; \
72-
fi; \
73-
useradd "${OPTS[@]}" builder; \
74-
' \
58+
# create the builder user
59+
RUN groupadd -g 1000 builder \
60+
&& useradd -u 1000 -g 1000 builder \
7561
&& echo "builder:builder" | chpasswd \
7662
&& echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
7763

7864
RUN mkdir -p /usr/local/bin
65+
RUN curl -fsSL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" -o /usr/local/bin/gosu \
66+
&& chmod +x /usr/local/bin/gosu
7967
COPY files/init-container.sh /usr/local/bin/init-container.sh
80-
COPY files/rpmmacros /home/builder/.rpmmacros
68+
COPY files/entrypoint.sh /usr/local/bin/entrypoint.sh
69+
COPY --chown=builder:builder files/rpmmacros /home/builder/.rpmmacros
70+
71+
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
72+
CMD ["bash"]

‎Dockerfile-9.x‎

Lines changed: 10 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,5 @@
11
FROM ghcr.io/almalinux/10-base:10.0
22

3-
ARG CUSTOM_BUILDER_UID=""
4-
ARG CUSTOM_BUILDER_GID=""
5-
63
# Add our repositories
74
# temporary bootstrap repository
85
COPY files/xcp-ng-8.99.repo /etc/yum.repos.d/xcp-ng.repo
@@ -49,25 +46,19 @@ RUN dnf install -y \
4946
xcp-ng-release \
5047
xcp-ng-release-presets
5148
52-
# Set up the builder user
53-
RUN bash -c ' \
54-
OPTS=(); \
55-
if [ -n "${CUSTOM_BUILDER_UID}" ]; then \
56-
OPTS+=("-u" "${CUSTOM_BUILDER_UID}"); \
57-
fi; \
58-
if [ -n "${CUSTOM_BUILDER_GID}" ]; then \
59-
OPTS+=("-g" "${CUSTOM_BUILDER_GID}"); \
60-
if ! getent group "${CUSTOM_BUILDER_GID}" >/dev/null; then \
61-
groupadd -g "${CUSTOM_BUILDER_GID}" builder; \
62-
fi; \
63-
fi; \
64-
useradd "${OPTS[@]}" builder; \
65-
' \
49+
# create the builder user
50+
RUN groupadd -g 1000 builder \
51+
&& useradd -u 1000 -g 1000 builder \
6652
&& echo "builder:builder" | chpasswd \
6753
&& echo "builder ALL=(ALL:ALL) NOPASSWD: ALL" >> /etc/sudoers
6854
6955
RUN mkdir -p /usr/local/bin
56+
RUN curl -fsSL "https://github.com/tianon/gosu/releases/download/1.17/gosu-amd64" -o /usr/local/bin/gosu \
57+
&& chmod +x /usr/local/bin/gosu
7058
COPY files/init-container.sh /usr/local/bin/init-container.sh
71-
59+
COPY files/entrypoint.sh /usr/local/bin/entrypoint.sh
7260
# FIXME: check it we really need any of this
73-
# COPY files/rpmmacros /home/builder/.rpmmacros
61+
# COPY --chown=builder:builder files/rpmmacros /home/builder/.rpmmacros
62+
63+
ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
64+
CMD ["bash"]

‎build.sh‎

Lines changed: 0 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -89,25 +89,6 @@ case "$1" in
8989
;;
9090
esac
9191

92-
CUSTOM_UID="$(id -u)"
93-
CUSTOM_GID="$(id -g)"
94-
95-
if [ "${CUSTOM_UID}" -eq 0 ] || [ "${CUSTOM_GID}" -eq 0 ]; then
96-
if [ -z "${SUDO_GID}" ] || [ -z "${SUDO_UID}" ] || [ -z "${SUDO_USER}" ] || \
97-
[ -z "${SUDO_COMMAND}" ] || [ "${SUDO_GID}" -eq 0 ] || [ "${SUDO_UID}" -eq 0 ]; then
98-
echo -e "[ERROR] This operation cannot be performed by the 'root' user directly:"
99-
echo -e "\tplease use an unprivileged user (eventually with 'sudo')"
100-
exit 1
101-
fi
102-
CUSTOM_UID="${SUDO_UID}"
103-
CUSTOM_GID="${SUDO_GID}"
104-
fi
105-
106-
# Support for seamless use of current host user
107-
# and Docker user "builder" inside the image
108-
CUSTOM_ARGS+=( "--build-arg" "CUSTOM_BUILDER_UID=${CUSTOM_UID}" )
109-
CUSTOM_ARGS+=( "--build-arg" "CUSTOM_BUILDER_GID=${CUSTOM_GID}" )
110-
11192
"$RUNNER" build \
11293
--platform "$PLATFORM" \
11394
"${CUSTOM_ARGS[@]}" \

‎files/entrypoint.sh‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
#!/usr/bin/env bash
2+
3+
set -e
4+
if [ -n "${SCRIPT_DEBUG}" ]; then
5+
set -x
6+
fi
7+
8+
if [ "${BUILDER_ID}" ]; then
9+
# BUILDER_ID is defined, update the builder ids, and continue with the builder user
10+
if [ "${BUILDER_ID}" != "1000:1000" ]; then
11+
uid=$(echo "$BUILDER_ID" | awk -F':' '{print $1}')
12+
gid=$(echo "$BUILDER_ID" | awk -F':' '{print $2}')
13+
groupmod -g "${gid}" builder
14+
usermod -u "${uid}" -g "${gid}" builder
15+
find ~builder -maxdepth 1 -type f | xargs chown builder:builder
16+
fi
17+
exec /usr/local/bin/gosu builder "$@"
18+
else
19+
# no BUILDER_ID, just continue as the current user
20+
exec "$@"
21+
fi

‎run.py‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -102,11 +102,13 @@ def main():
102102
docker_arch = args.platform or ("linux/amd64/v2" if branch == "9.0" else "linux/amd64")
103103

104104
docker_args = [RUNNER, "run", "-i", "-t",
105-
"-u", "builder",
106105
"--platform", docker_arch,
107106
]
108107
if is_podman(RUNNER):
109-
docker_args += ["--userns=keep-id"]
108+
docker_args += [f"--userns=keep-id:uid=1000,gid=1000"]
109+
else:
110+
docker_args += ["-e", f'BUILDER_ID={os.getuid()}:{os.getgid()}']
111+
110112
if args.rm:
111113
docker_args += ["--rm=true"]
112114

0 commit comments

Comments
 (0)