docker runner fails if package has a subpackage #1254
Comments
|
This also fails on ubuntu 24.04 (did not test elsewhere). |
|
Doesn't fail for me on macos :/ |
|
I'm not sure if I reported this in user-error , old version of melange (why did I not put the melange version in the report?) or what. |
smoser
added a commit
to smoser/melange
that referenced
this issue
Nov 14, 2024
Moving the creation of the subpackage dir before running the
pipelines means that the subpackage directory was created as
the user that ran melange rather than the user that is
doing the build. Those uids can be different depending on
the runner.
SBOMs are written as the uid that invoked melange. It assumes
that it can create Workspace/package-dir/var/lib/db/sbom . Previously,
the 'package-dir' portion of that would sometimes get created
by the uid inside the build (probably as a result of
'mkdir -p ${{targets.contextdir}}/usr/bin' or the like). The result
was that the uid running melange could not create var/lib/db/sbom
because it did not have write perms to package-dir.
By creating package-dir first, we (mostly) ensure that we can later
create var/lib/db/sbom, and this will succeed more often.
There is still a problem in that we assume that we can write there.
Some part of the build might create var/lib/db and have all those
tokens as 755 with a different uid. The right solution is probably
to do the population from inside the Runner.
This improves the situation for
chainguard-dev#1254,
but does not entirely fix it.
Signed-off-by: Scott Moser <[email protected]>
smoser
added a commit
to smoser/melange
that referenced
this issue
Nov 14, 2024
Moving the creation of the subpackage dir before running the
pipelines means that the subpackage directory was created as
the user that ran melange rather than the user that is
doing the build. Those uids can be different depending on
the runner.
SBOMs are written as the uid that invoked melange. It assumes
that it can create Workspace/package-dir/var/lib/db/sbom . Previously,
the 'package-dir' portion of that would sometimes get created
by the uid inside the build (probably as a result of
'mkdir -p ${{targets.contextdir}}/usr/bin' or the like). The result
was that the uid running melange could not create var/lib/db/sbom
because it did not have write perms to package-dir.
By creating package-dir first, we (mostly) ensure that we can later
create var/lib/db/sbom, and this will succeed more often.
There is still a problem in that we assume that we can write there.
Some part of the build might create var/lib/db and have all those
tokens as 755 with a different uid. The right solution is probably
to do the population from inside the Runner.
This improves the situation for
chainguard-dev#1254,
but does not entirely fix it.
Signed-off-by: Scott Moser <[email protected]>
4 tasks
This was referenced Nov 15, 2024
|
I can confirm this is still applicable. Just reproduced it with Melange 0.19.1 on Linux where dockerd runs as 0, using the Docker Melange runner on |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
This is from wolfi-dev/os at 88a385e2a4c462cbf1a527df15ae99fe70ae9d48
2 things will make this work:
The text was updated successfully, but these errors were encountered: