search

suborbital / subo

The Suborbital CLI
Apache License 2.0
81 stars 24 forks source link

Docker toolchain build artifacts are created under the root user on Linux #175

Open flaki opened 2 years ago

flaki commented 2 years ago

I'm seeing a weird issue on Linux (Ubuntu 20.04, running as my own user flaki) where subo build . would use the docker build method to build the Rust runnables, and while the runnables.wasm.zip bundle comes out perfectly fine (flaki:flaki user/group), the build artifacts end up in folders that are root:root-owned and cannot be deleted without using sudo.

image

As a result, subo clean fails also without a sudo: image

flaki commented 2 years ago

Okay so this is because we are invoking the toolchain that, by default, runs as root and the mounted volume ends up written by root. It looks like we are missing something to the tune of docker run -u=$UID:$GID from the dockerBuildForLang invocation.

@jagger27 not sure what would be the Go-ism for pulling the currently executing UID/GID from the environment here (or maybe we want to sample the owner/group of the project directory and use those?), but otherwise would be happy to give this PR a Go (hehe).

flaki commented 2 years ago

Discussed this in chat. The error is Linux-specific, as Docker on Mac OS uses NFS mounts which just "happened to work correctly here". There were previous attempts on fixing this, but we should explore if the docker run -u method is viable.

Me (and @jagger27) will do some testing, if going rootless doesn't break the toolchains than we will try to find a way to get this fixed.

flaki commented 2 years ago

Current draft PR (see above) fixes the issue and the breakage introduced in the Rust builder image, will need to make sure the rest of the images are working.