bamurtaugh
commented
9 months ago Thanks for taking the time to share this. @joshspicer I'd love to get your thoughts!
Open scottcwang opened 11 months ago
bamurtaugh
commented
9 months ago Thanks for taking the time to share this. @joshspicer I'd love to get your thoughts!
joshspicer
commented
9 months ago Thanks for the report!
I am not able to reproduce in Codespaces (copied your repro to here if you'd like to try), or locally with the latest version of the CLI on my Mac (using Docker desktop as the engine).
One thing that stands out to me is that you appear to be using podman as the container runtime. I suspect that's what causing this behavior.
Could you please share more specific details about the container runtime and your local environment?
...
...
2024-01-26 01:00:56.019Z: @devcontainers/cli 0.54.2. Node.js v18.19.0. linux 6.2.0-1018-azure x64.
2024-01-26 01:00:56.449Z: Running the postCreateCommand from devcontainer.json...
2024-01-26 01:00:56.449Z: env ; getent passwd vscode
2024-01-26 01:00:56.677Z: GITHUB_TOKEN=********
GITHUB_CODESPACE_TOKEN=********
USER=vscode
HOSTNAME=codespaces-bb5a32
SHLVL=1
GITHUB_CODESPACES_PORT_FORWARDING_DOMAIN=********
HOME=/home/vscode
OLDPWD=/
CODESPACES=********
...
...
GITHUB_REPOSITORY=********
RUST_VERSION=1.75.0
INTERNAL_VSCS_TARGET_URL=********
PWD=/workspaces/lifecycle-hook-nonroot
CODESPACE_NAME=********
2024-01-26 01:00:56.677Z: vscode:x:1000:1000::/home/vscode:/bin/bash[/tmp/lifecycle-hook-nonroot]$ devcontainer up --workspace-folder . [main]
[1 ms] @devcontainers/cli 0.56.1. Node.js v21.5.0. darwin 23.2.0 arm64.
bullseye: Pulling from devcontainers/rust
396a672fee8b: Pull complete
010797996cc8: Pull complete
70092c2a6b38: Pull complete
0cc4a505c38c: Pull complete
2b84a6755876: Pull complete
b2b660dea17e: Pull complete
e3d4c4bd8edf: Pull complete
d9001fc11894: Pull complete
121c45753b1c: Pull complete
f9309211e334: Pull complete
856b37b17c05: Pull complete
81f80730bc41: Pull complete
ac7f7e78f95e: Pull complete
Digest: sha256:a0435af438f3a2db733ce96ed7e10482f39aa76a4b8b83d09c5e69a13e7c684d
Status: Downloaded newer image for mcr.microsoft.com/devcontainers/rust:bullseye
mcr.microsoft.com/devcontainers/rust:bullseye
[58329 ms] Start: Run: docker run --sig-proxy=false -a STDOUT -a STDERR --mount type=bind,source=/private/tmp/lifecycle-hook-nonroot,target=/workspaces/lifecycle-hook-nonroot,consistency=cached -l devcontainer.local_folder=/private/tmp/lifecycle-hook-nonroot -l devcontainer.config_file=/private/tmp/lifecycle-hook-nonroot/.devcontainer/devcontainer.json --cap-add SYS_PTRACE --security-opt seccomp=unconfined --entrypoint /bin/sh -l devcontainer.metadata=[{"id":"ghcr.io/devcontainers/features/common-utils:2"},{"id":"ghcr.io/devcontainers/features/git:1"},{"id":"ghcr.io/devcontainers/features/rust:1","capAdd":["SYS_PTRACE"],"securityOpt":["seccomp=unconfined"],"customizations":{"vscode":{"extensions":["vadimcn.vscode-lldb","rust-lang.rust-analyzer","tamasfe.even-better-toml","serayuzgur.crates"],"settings":{"files.watcherExclude":{"**/target/**":true}}}}},{"remoteUser":"vscode"},{"postCreateCommand":"env ; getent passwd vscode"}] mcr.microsoft.com/devcontainers/rust:bullseye -c echo Container started
Container started
Running the postCreateCommand from devcontainer.json...
USER=vscode
HOSTNAME=671ae88f75a3
SHLVL=1
HOME=/home/vscode
_=/bin/cat
PROMPT_DIRTRIM=4
TERM=xterm
RUSTUP_HOME=/usr/local/rustup
PATH=/usr/local/cargo/bin:/usr/local/cargo/bin:/usr/local/cargo/bin:/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/vscode/.local/bin
LS_COLORS=
RUST_VERSION=1.75.0
PWD=/workspaces/lifecycle-hook-nonroot
CARGO_HOME=/usr/local/cargo
vscode:x:1000:1000::/home/vscode:/bin/bash
{"outcome":"success","containerId":"671ae88f75a329252b7a16b3c6ae1d6234005a176a2ca2f9fea1bb01e085f8df","remoteUser":"vscode","remoteWorkspaceFolder":"/workspaces/lifecycle-hook-nonroot"}
[/tmp/lifecycle-hook-nonroot]$[/tmp/lifecycle-hook-nonroot]$ devcontainer up --workspace-folder . [main]
[1 ms] @devcontainers/cli 0.56.1. Node.js v21.5.0. darwin 23.2.0 arm64.
bullseye: Pulling from devcontainers/rust
396a672fee8b: Pull complete
010797996cc8: Pull complete
70092c2a6b38: Pull complete
0cc4a505c38c: Pull complete
2b84a6755876: Pull complete
b2b660dea17e: Pull complete
e3d4c4bd8edf: Pull complete
d9001fc11894: Pull complete
121c45753b1c: Pull complete
f9309211e334: Pull complete
856b37b17c05: Pull complete
81f80730bc41: Pull complete
ac7f7e78f95e: Pull complete
Digest: sha256:a0435af438f3a2db733ce96ed7e10482f39aa76a4b8b83d09c5e69a13e7c684d
Status: Downloaded newer image for mcr.microsoft.com/devcontainers/rust:bullseye
mcr.microsoft.com/devcontainers/rust:bullseye
[58329 ms] Start: Run: docker run --sig-proxy=false -a STDOUT -a STDERR --mount type=bind,source=/private/tmp/lifecycle-hook-nonroot,target=/workspaces/lifecycle-hook-nonroot,consistency=cached -l devcontainer.local_folder=/private/tmp/lifecycle-hook-nonroot -l devcontainer.config_file=/private/tmp/lifecycle-hook-nonroot/.devcontainer/devcontainer.json --cap-add SYS_PTRACE --security-opt seccomp=unconfined --entrypoint /bin/sh -l devcontainer.metadata=[{"id":"ghcr.io/devcontainers/features/common-utils:2"},{"id":"ghcr.io/devcontainers/features/git:1"},{"id":"ghcr.io/devcontainers/features/rust:1","capAdd":["SYS_PTRACE"],"securityOpt":["seccomp=unconfined"],"customizations":{"vscode":{"extensions":["vadimcn.vscode-lldb","rust-lang.rust-analyzer","tamasfe.even-better-toml","serayuzgur.crates"],"settings":{"files.watcherExclude":{"**/target/**":true}}}}},{"remoteUser":"vscode"},{"postCreateCommand":"env ; getent passwd vscode"}] mcr.microsoft.com/devcontainers/rust:bullseye -c echo Container started
Container started
Running the postCreateCommand from devcontainer.json...
USER=vscode
HOSTNAME=671ae88f75a3
SHLVL=1
HOME=/home/vscode
_=/bin/cat
PROMPT_DIRTRIM=4
TERM=xterm
RUSTUP_HOME=/usr/local/rustup
PATH=/usr/local/cargo/bin:/usr/local/cargo/bin:/usr/local/cargo/bin:/usr/local/cargo/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/home/vscode/.local/bin
LS_COLORS=
RUST_VERSION=1.75.0
PWD=/workspaces/lifecycle-hook-nonroot
CARGO_HOME=/usr/local/cargo
vscode:x:1000:1000::/home/vscode:/bin/bash
{"outcome":"success","containerId":"671ae88f75a329252b7a16b3c6ae1d6234005a176a2ca2f9fea1bb01e085f8df","remoteUser":"vscode","remoteWorkspaceFolder":"/workspaces/lifecycle-hook-nonroot"}
[/tmp/lifecycle-hook-nonroot]$
scottcwang
commented
9 months ago Thanks @joshspicer. Indeed, I am using the podman container engine on Fedora 39. Wow, I'm not sure how I forgot to mention that crucial detail. Sorry about that.
In my setup, I have the docker socket symlinked to my user's rootless podman socket, so that the docker CLI connects to the rootless podman engine:
sudo ln --force --symbolic /run/user/$(id --user)/podman/podman.sock /var/run/docker.sock
devcontainer up --workspace-folder test1 --log-level verboseNow, if I do podman exec --latest whoami, I get root, and podman exec --latest mkdir -p /root/.devcontainer succeeds (and podman exec --latest ls /root shows the directory correctly). But if I instead do podman exec --user vscode --latest mkdir -p /root/.devcontainer, I get mkdir: cannot create directory '/root': Permission denied, which is the same error message as reported above in the devcontainer debug logs. So it seems as though devcontainer is trying to run mkdir -p /root/.devcontainer as the remoteUser user, whereas it should be running it as root. I'm not sure why docker doesn't have this problem.
This issue also occurs when running podman as root:
sudo systemctl enable --now podman.socket
sudo ln --force --symbolic /run/podman/podman.sock /var/run/docker.sock
sudo devcontainer up --workspace-folder test1 --log-level verbose
viktorianer
commented
1 month ago To address the issue in the Podman environment where the postCreateCommand is not executed, you can use the following workaround:
Preferred Solution: Add "containerUser": "vscode" to the .devcontainer/devcontainer.json file. This ensures that all commands are run as the vscode user, preventing permission issues that occur when commands attempt to run as root.
Alternative Solution: Add user: "vscode" to the service definition in .devcontainer/compose.yaml, which is defined as the execution service in the "service" field of the .devcontainer/devcontainer.json. This also forces the container to use the vscode user.
This resolves the permission issues with Podman where the container might incorrectly attempt to run commands as root, causing failures with postCreateCommand.
Related to https://github.com/microsoft/vscode-remote-release/issues/6206?
Observed
Given the following
test1/.devcontainer/devcontainer.json(where the image usesvscodeas theremoteUser:The
postCreateCommanddoes not run at all, butdevcontainer upstill returns success:However, setting
remoteUserto root, as in thistest2/.devcontainer/devcontainer.json:allows the
postCreateCommandto run:Expected
remoteUser/root/.devcontainerregardless of who theremoteUseris (or, more generally, this should work as designed)devcontainer upshould fail