GEM_HOME world writable?

[lhm]

Is this really necessary?
https://github.com/docker-library/ruby/blob/master/2.3/Dockerfile#L54
https://github.com/docker-library/ruby/blob/master/2.3/Dockerfile#L32

It appears to have been introduced by #68 and #69, in response to #66. I can see how it solves that issue, but I think I disagree with the use-case. I may be missing something, but isn't installing gems at 'runtime' rarely needed? In general (as far as I understand docker) bundle install should be run when building the image.

[rhys-vdw]

@lhm Your links point to master instead of a specific commit. master now points to a different commit and they now point to different lines.

[yosifkit]

Sorry I didn't see this issue earlier; it is probably line 70 now. Yes, for production you would be running the bundle install during the build. While your developers would be using the same Dockerfile, they would probably also be bind mounting their working code directory into the container and having the container start with a script that does a bundle install before starting the app. That way a simple docker restart to get new gems and they don't have to wait for all gems of the project to install. And the container user id can be the same as their local user so that if they need the container to update Gemfile.lock, it isn't suddenly owned by root.

[lhm]

@rhys-vdw @yosifkit Sorry for the silly link, this is the line I meant:

ruby/2.3/Dockerfile

Line 40 in aba4590

echo '#define ENABLE_PATH_CHECK 0'; \

It's about patching file.c to set ENABLE_PATH_CHECK=0 in order to remove a warning. I think this is where this warning is coming from: https://github.com/ruby/ruby/blob/edcec2b44a79f691cbeb05e98c3c01662169edca/file.c#L5648

I'm not really sure it's a problem, but I raises some eyebrows.

[lhm]

The references to the linked issues basically came from looking at git blame to see where the code was introduced.

[yosifkit]

As far as I know, it is just to suppress the warning about "warning: Insecure world writable dir". Since we wanted to allow the container to run as any user it makes it nicer for the user to not have an unneeded warning. It was added in #68 and clarified in #88.

[wglambert]

Since this question seems unrelated to any errors in the image itself, and being a year without further comment, I'm going to prune the issue.
If you believe this to be in error then let me know and I'll re-open it