Dojo fails to get the correct UID with Docker "Use gRPC FUSE for file sharing" setting turned on

[aiwatko]

Expected behaviour

olduid == newuid == <id>, nothing to do

Actual behaviour

After installing 2.4.0.0 Docker update, dojo fails to get the correct UID when docker "Use gRPC FUSE for file sharing" setting is turned on:

+ usermod -u 0 dojo
usermod: UID '0' already exists
+ groupmod -g 0 dojo
groupmod: GID '0' already exists

The following Docker issue might be related: https://github.com/docker/for-mac/issues/4959

[xmik]

Hi! Thanks for your time to open this issue. I don't have the solution right now, but I'm going to write what I know.

• FUSE is also used in Docker Desktop Windows and there is also an issue with setting the volume ownership
• there is a new version of Docker for Mac 2.4.1.0. It says to have "Fixed a possible premature file handle close when using gRPC-FUSE". I don't believe it fixes this issue but nevertheless, it could be worth a try to test this version.
• maybe you could choose osxfs instead of FUSE? There are mixed opinions on FUSE, e.g.:
  • gRPC FUSE file system is significantly less performant than the osxfs system
  • FUSE offers not much different performance
  • gRCP FUSE is not faster in all cases, but it is faster in cases where the file sharing is CPU bound

[tomzo]

This bug is caused by a change in behaviour of the docker volume driver on Macs. The current workaround is to switch back to the old driver by unticking the "Use gRPC FUSE for file sharing".

FUSE driver behaviour

The FUSE driver makes the mounted directory owned by the user that is specified in the -u option to docker run command:

$ docker run -u dojo --volume $PWD:/dojo/work --entrypoint '/bin/bash' -ti kudulab/openjdk-dojo -c "ls -la /dojo/work"
total 4
drwxr-xr-x 2 dojo dojo   64 Oct 20 19:20 .
drwxr-xr-x 3 root root 4096 Oct 20 19:20 ..

$ docker run --volume $PWD:/dojo/work --entrypoint '/bin/bash' -ti kudulab/openjdk-dojo -c "ls -la /dojo/work"
total 4
drwxr-xr-x 2 root root   64 Oct 20 19:20 .
drwxr-xr-x 3 root root 4096 Oct 20 19:21 ..

osxfs driver behaviour

Previous driver was different. The mounted directory was owned by the user that is running the current process.

$ docker run --volume $PWD:/dojo/work --entrypoint '/bin/bash' -ti kudulab/openjdk-dojo -c bash
root@654102fe528f:/# ls -la /dojo/work
total 4
drwxr-xr-x 2 root root   64 Oct 20 19:20 .
drwxr-xr-x 3 root root 4096 Oct 20 19:28 ..
root@654102fe528f:/# su dojo
dojo@654102fe528f(openjdk-dojo):/$ ls -la /dojo/work
total 4
drwxr-xr-x 2 dojo dojo   64 Oct 20 19:20 .
drwxr-xr-x 3 root root 4096 Oct 20 19:28 ..

Next steps

We'll probably have to change the way dojo executes docker run and how we handle the uid/gid problem. Ideally we should find a way which does not break existing images and extends compatibility across platforms.

I'll post more ideas later. Happy to hear other peoples thoughts on this.

[tomzo]

I didn't notice this before. (when ran on Mac with the FUSE driver) Apparently the mounted directory is owned by dojo when entrypoint eventually switches to dojo user:

$ docker run --volume $PWD:/dojo/work -ti kudulab/openjdk-dojo -c "ls -la /dojo/work"
24-10-2020 17:55:15 Dojo entrypoint info: Sourcing: /etc/dojo.d/variables/50-variables.sh
24-10-2020 17:55:15 Dojo entrypoint info: Sourcing: /etc/dojo.d/variables/61-java-variables.sh
24-10-2020 17:55:15 Dojo entrypoint info: Sourcing: /etc/dojo.d/scripts/20-setup-identity.sh
/dojo/identity/.ssh does not exist
24-10-2020 17:55:15 Dojo entrypoint info: Sourcing: /etc/dojo.d/scripts/50-fix-uid-gid.sh
+ usermod -u 0 dojo
usermod: UID '0' already exists
+ groupmod -g 0 dojo
groupmod: GID '0' already exists
+ chown 0:0 -R /home/dojo
24-10-2020 17:55:15 Dojo entrypoint info: Sourcing: /etc/dojo.d/scripts/90-run-user.sh
24-10-2020 17:55:15 Dojo entrypoint info: dojo init finished (interactive shell)
total 4
drwxr-xr-x 2 dojo dojo   64 Oct 24 17:54 .
drwxr-xr-x 3 root root 4096 Oct 24 17:55 ..

Which means that mounts still have the desired owner like on the legacy driver. It's only the detection of uid/gid ran in fix-uid-gid script that's not working anymore (when ran on Mac with the FUSE driver) - it reads 0 and then chowns the /home/dojo to be owned by root which breaks some images which rely on home.

[tomzo]

This is now fixed in Dojo image scripts version 0.10.2

For anyone running into this problem, there are 2 ways to proceed

• Rebuild docker image using Dojo image scripts 0.10.2 or higher
• Or workaround by switching back to the legacy osx docker volume driver by unticking the "Use gRPC FUSE for file sharing".