Paths

Table of Contentst

Differential D2342

Build Arcanist Docker images by user
ClosedPublic
Actions

Authored by dereckson on Sep 28 2020, 23:58.

Details

Reviewers

dereckson

Commits

rOPS4d419de04afb: Build Arcanist Docker images by user

Summary

On Docker development server, arc shell offers a Debian userland
with Arcanist and Git to interact with Phabricator repositories,
commit, merge, etc.

This is intended to ease the test and maintenance of the Docker images
repositories directly on a Docker development server.

Currently, those containers run as root. Regardless if it's acceptable
or not from a security point of view, this method has a major usability
drawback when the Git index is manipulated, as it populates files owned
by root, requiring afterwards a chown.

This change offers to run the container under the own user id. This user
must exist in the image to avoid issues with SSH client and should exist
to avoid the "I have no name!" prompt. As such, a custom build is needed.

The custom image uses the set (UID, GID) as image tag. The GID ensures
minimal friction when creating directories or working with group permissions.

Test Plan

Build on Dwellers
arc shell created and used nasqueron/arcanist:5001-5001 image
SSH works
arc shell doesn't try to build the image a second time

Diff Detail

Repository

rOPS Nasqueron Operations

Lint

Lint Not Applicable

Unit

Tests Not Applicable

Event Timeline

dereckson requested review of this revision.Sep 28 2020, 23:58

dereckson created this revision.

Harbormaster completed remote builds in B3639: Diff 5897.Sep 28 2020, 23:58

Some shellcheck fixes

Harbormaster completed remote builds in B3640: Diff 5898.Sep 29 2020, 00:12

UID is readonly on current Debian sh implementation

Harbormaster completed remote builds in B3641: Diff 5899.Sep 29 2020, 01:05

dereckson accepted this revision.Sep 29 2020, 01:05

This revision is now accepted and ready to land.Sep 29 2020, 01:05

This revision was landed with ongoing or failed builds.Sep 29 2020, 01:06

Closed by commit rOPS4d419de04afb: Build Arcanist Docker images by user (authored by dereckson). · Explain Why

This revision was automatically updated to reflect the committed changes.

dereckson added a commit: rOPS4d419de04afb: Build Arcanist Docker images by user.

Output test with echo before 'docker run' commands

First run

$ arc shell
🔨 Building user-specific image nasqueron/arcanist:5001-5001 for dereckson
Sending build context to Docker daemon  2.048kB
Step 1/2 : FROM nasqueron/arcanist
 ---> 6e4174e6e254
Step 2/2 : RUN groupadd -r dereckson -g 5001 && mkdir /home/dereckson && useradd -u 5001 -r -g dereckson -d /home/dereckson -s /bin/bash
dereckson && chown -R dereckson:dereckson /home/dereckson
 ---> Running in a1e36597c0f8
Removing intermediate container a1e36597c0f8
 ---> c4205037320b
Successfully built c4205037320b
Successfully tagged nasqueron/arcanist:5001-5001
docker run -it --rm --user 5001:5001 -v /home/dereckson/.arc:/opt/config -v /home/dereckson/dev/docker/php-cli:/opt/workspace -v /home/dereckson/.arc/ssh:/home/dereckson/.ssh nasqueron/arcanist:5001-5001 bash

Second run

$ arc shell
docker run -it --rm --user 5001:5001 -v /home/dereckson/.arc:/opt/config -v /home/dereckson/dev/docker/php-cli:/opt/workspace -v /home/dereckson/.arc/ssh:/home/dereckson/.ssh nasqueron/arcanist:5001-5001 bash

Revision Contents
Changeset List

Path

Size

roles/

paas-docker/

devel/

files/

arc.sh

29 lines

Diff 5900

View Options

roles/paas-docker/devel/files/arc.sh

Build Arcanist Docker images by userClosedPublicActions