support/dockerfile: add directives to run as non-root
PATCH 1/1 support/dockerfile: add directives to run as non-root
Currently, our jobs on the gitlab-ci infra are running as root, which is problematic for two reasons:
- this is not the usual way Buildroot is built;
- it may miss issues where running as non-root is problematic.
So, complement our Dockerfile with directives to add a new user and run everything as that user, as demonstrated by this build job:
https://gitlab.com/ymorin/buildroot-ci/-/jobs/46929562
Additional, enforce an UTF-8 locale while running.
--- support/docker/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+)
support/docker/Dockerfile +7 -0
@@ -28,3 +28,10 @@ RUN apt-get -q -y clean RUN sed -i 's/# \(en_US.UTF-8\)/\1/' /etc/locale.gen RUN /usr/sbin/locale-gen +RUN useradd -ms /bin/bash br-user +RUN chown -R br-user:br-user /home/br-user + +USER br-user +WORKDIR /home/br-user +ENV HOME /home/br-user +ENV LC_ALL en_US.UTF-8
Signature · 1 line
2.11.0
PATCH 1/1 support/dockerfile: add directives to run as non-root
Hello,
Quoted 12 lines · Yann E. MORIN
Currently, our jobs on the gitlab-ci infra are running as root, which is problematic for two reasons:
- this is not the usual way Buildroot is built;
- it may miss issues where running as non-root is problematic.So, complement our Dockerfile with directives to add a new user and run everything as that user, as demonstrated by this build job:
https://gitlab.com/ymorin/buildroot-ci/-/jobs/46929562Additional, enforce an UTF-8 locale while running.
Quoted 7 lines
Signed-off-by "Yann E. MORIN" <[email protected]>Cc Arnout Vandecappelle <[email protected]>Cc Peter Korsgaard <[email protected]>Cc Thomas Petazzoni <[email protected]>--- support/docker/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+)
Applied to master, thanks. Could you update the official Buildroot Docker image, so that the Gitlab CI testing benefits from this ?
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
PATCH 1/1 support/dockerfile: add directives to run as non-root
Thomas, All,
On 2018-01-12 22:54 +0100, Thomas Petazzoni spake thusly:
Quoted 21 lines · Yann E. MORIN
Quoted 12 lines
Currently, our jobs on the gitlab-ci infra are running as root, which is problematic for two reasons:
- this is not the usual way Buildroot is built;
- it may miss issues where running as non-root is problematic.So, complement our Dockerfile with directives to add a new user and run everything as that user, as demonstrated by this build job:
https://gitlab.com/ymorin/buildroot-ci/-/jobs/46929562Additional, enforce an UTF-8 locale while running.
Quoted 7 lines
Signed-off-by "Yann E. MORIN" <[email protected]>Cc Arnout Vandecappelle <[email protected]>Cc Peter Korsgaard <[email protected]>Cc Thomas Petazzoni <[email protected]>--- support/docker/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+)
Quoted 2 lines
Applied to master, thanks. Could you update the official Buildroot Docker image, so that the Gitlab CI testing benefits from this ?
I would if I could, but I am not supposed to have push-access to that image, have I?
Regards,
Yann E. MORIN.
Quoted 7 lines
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux, Kernel and Android engineering http://free-electrons.com
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH 1/1 support/dockerfile: add directives to run as non-root
Hello,
Quoted 22 lines · Yann E. MORIN
On 2018-01-12 22:54 +0100, Thomas Petazzoni spake thusly:
Quoted 21 lines · Yann E. MORIN
Quoted 19 lines
Currently, our jobs on the gitlab-ci infra are running as root, which is problematic for two reasons:
- this is not the usual way Buildroot is built;
- it may miss issues where running as non-root is problematic.So, complement our Dockerfile with directives to add a new user and run everything as that user, as demonstrated by this build job:
https://gitlab.com/ymorin/buildroot-ci/-/jobs/46929562Additional, enforce an UTF-8 locale while running.
Signed-off-by "Yann E. MORIN" <[email protected]>Cc Arnout Vandecappelle <[email protected]>Cc Peter Korsgaard <[email protected]>Cc Thomas Petazzoni <[email protected]>--- support/docker/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+)
Quoted 5 lines
Quoted 2 lines
Applied to master, thanks. Could you update the official Buildroot Docker image, so that the Gitlab CI testing benefits from this ?
I would if I could, but I am not supposed to have push-access to that image, have I?
I am not sure how that works. Hopefully Arnout can give some details about this :)
Best regards,
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Free Electrons Embedded Linux and Kernel engineering http://free-electrons.com
PATCH 1/1 support/dockerfile: add directives to run as non-root
Quoted 26 lines · Thomas Petazzoni
Hello,
Quoted 22 lines · Yann E. MORIN
On 2018-01-12 22:54 +0100, Thomas Petazzoni spake thusly:
Quoted 21 lines · Yann E. MORIN
Quoted 19 lines
Currently, our jobs on the gitlab-ci infra are running as root, which is problematic for two reasons:
- this is not the usual way Buildroot is built;
- it may miss issues where running as non-root is problematic.So, complement our Dockerfile with directives to add a new user and run everything as that user, as demonstrated by this build job:
https://gitlab.com/ymorin/buildroot-ci/-/jobs/46929562Additional, enforce an UTF-8 locale while running.
Signed-off-by "Yann E. MORIN" <[email protected]>Cc Arnout Vandecappelle <[email protected]>Cc Peter Korsgaard <[email protected]>Cc Thomas Petazzoni <[email protected]>--- support/docker/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+)
Quoted 8 lines
Quoted 5 lines
Quoted 2 lines
Applied to master, thanks. Could you update the official Buildroot Docker image, so that the Gitlab CI testing benefits from this ?
I would if I could, but I am not supposed to have push-access to that image, have I?
I am not sure how that works. Hopefully Arnout can give some details about this :)
The idea was that more people than just me would create an account on
hub.docker.io, and I would add them to the buildroot organisation.
For now, I've pushed the updated docker image.
Regards,
Arnout
Signature · 6 lines
Arnout Vandecappelle arnout at mind be Senior Embedded Software Architect +32-16-286500 Essensium/Mind http://www.mind.be G.Geenslaan 9, 3001 Leuven, Belgium BE 872 984 063 RPR Leuven LinkedIn profile: http://www.linkedin.com/in/arnoutvandecappelle GPG fingerprint: 7493 020B C7E3 8618 8DEC 222C 82EB F404 F9AC 0DDF
PATCH 1/1 support/dockerfile: add directives to run as non-root
In reply to Yann E. MORINQuoted 27 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
Currently, our jobs on the gitlab-ci infra are running as root, which is problematic for two reasons:
- this is not the usual way Buildroot is built;
- it may miss issues where running as non-root is problematic.So, complement our Dockerfile with directives to add a new user and run everything as that user, as demonstrated by this build job:
https://gitlab.com/ymorin/buildroot-ci/-/jobs/46929562Additional, enforce an UTF-8 locale while running.
Signed-off-by "Yann E. MORIN" <[email protected]>Cc Arnout Vandecappelle <[email protected]>Cc Peter Korsgaard <[email protected]>Cc Thomas Petazzoni <[email protected]>--- support/docker/Dockerfile | 7 +++++++ 1 file changed, 7 insertions(+)support/docker/Dockerfile +0
-0
support/docker/Dockerfile RUN apt-get -q -y clean · line 32
Quoted 5 lines
support/docker/Dockerfile +2
-0@@ -28,3 +28,10 @@ RUN apt-get -q -y clean RUN sed -i 's/# \(en_US.UTF-8\)/\1/' /etc/locale.gen RUN /usr/sbin/locale-gen +RUN useradd -ms /bin/bash br-user +RUN chown -R br-user:br-user /home/br-user
I don't know much about Docker, but I was of the understanding that each run statement creates a new layer and the number of layers should be minimized, which is why you normally see stuff like:
RUN foo && \
bar && \
foz && \
bazE.G. from the official documentation:
Signature · 1 line
Bye, Peter Korsgaard
PATCH 1/1 support/dockerfile: add directives to run as non-root
Peter, All,
On 2018-02-03 22:47 +0100, Peter Korsgaard spake thusly:
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
[--SNIP--]
Quoted 15 lines
support/docker/Dockerfile RUN apt-get -q -y clean · line 32
Quoted 10 lines
support/docker/Dockerfile +2
-0@@ -28,3 +28,10 @@ RUN apt-get -q -y clean RUN sed -i 's/# \(en_US.UTF-8\)/\1/' /etc/locale.gen RUN /usr/sbin/locale-gen +RUN useradd -ms /bin/bash br-user +RUN chown -R br-user:br-user /home/br-userI don't know much about Docker, but I was of the understanding that each run statement creates a new layer and the number of layers should be minimized, which is why you normally see stuff like:
Quoted 4 lines
RUN foo && \
bar && \
foz && \
bazWell, I am no docker expert either, and I just mimicked whatever the file already looked like, as you can see for the previous two lines...
Quoted 2 lines
E.G. from the official documentation:
https://docs.docker.com/develop/develop-images/dockerfile_best-practices/#minimize-the-number-of-layers
It's always time for a docker expert to send a fixup patch, eh! ;-) Or I can have a look if I again get bored not to be in BRU... ;-]
Regards,
Yann E. MORIN.
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH 1/1 support/dockerfile: add directives to run as non-root
Peter, All,
On 2018-02-04 11:04 +0100, Yann E. MORIN spake thusly:
Quoted 4 lines
On 2018-02-03 22:47 +0100, Peter Korsgaard spake thusly:
Quoted 3 lines
I don't know much about Docker, but I was of the understanding that each run statement creates a new layer and the number of layers should be minimized, which is why you normally see stuff like:
[--SNIP--]
Quoted 2 lines
It's always time for a docker expert to send a fixup patch, eh! ;-) Or I can have a look if I again get bored not to be in BRU... ;-]
There, I *really* got bored not being at FOSDEM...
https://patchwork.ozlabs.org/project/buildroot/list/?series=26863
Regards,
Yann E. MORIN.
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH 1/1 support/dockerfile: add directives to run as non-root
In reply to Yann E. MORINQuoted 20 lines · Yann E. MORIN
Peter, All,
On 2018-02-03 22:47 +0100, Peter Korsgaard spake thusly:
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
[--SNIP--]
Quoted 15 lines
support/docker/Dockerfile RUN apt-get -q -y clean · line 32
Quoted 10 lines
support/docker/Dockerfile +2
-0@@ -28,3 +28,10 @@ RUN apt-get -q -y clean RUN sed -i 's/# \(en_US.UTF-8\)/\1/' /etc/locale.gen RUN /usr/sbin/locale-gen +RUN useradd -ms /bin/bash br-user +RUN chown -R br-user:br-user /home/br-userI don't know much about Docker, but I was of the understanding that each run statement creates a new layer and the number of layers should be minimized, which is why you normally see stuff like:
Quoted 7 lines
Quoted 4 lines
RUN foo && \ bar && \ foz && \ bazWell, I am no docker expert either, and I just mimicked whatever the file already looked like, as you can see for the previous two lines...
Minimizing the number of layers for simple layers like the "RUN useradd" and "RUN chown" really doesn't save very much.
Where the big win comes in (and is not mentioned in the official documentation) is when you keep the "install && build && clean" commands in a single RUN command. This matters because if you split it up over multiple layers, the earlier layers still contain all the stuff the later layers try to clean. The end result is a fat image that contains the stuff you wanted to remove in a lower layer, with whiteout entries in a higher layer, so it only looks like the files have been removed.
Your patch set does the right thing WRT the debian install/clean, so all good, but I thought I'd mention this because it did not come up in any discussions here or in the linked docs.
PATCH 1/1 support/dockerfile: add directives to run as non-root
Cam, All,
On 2018-02-05 14:52 +1100, Cam Hutchison spake thusly:
Quoted 1 line · Yann E. MORIN
[--SNIP--]
Quoted 3 lines
Quoted 3 lines
Quoted 3 lines
I don't know much about Docker, but I was of the understanding that each run statement creates a new layer and the number of layers should be minimized, which is why you normally see stuff like:
[--SNIP--]
Quoted 11 lines
Minimizing the number of layers for simple layers like the "RUN useradd" and "RUN chown" really doesn't save very much.
Where the big win comes in (and is not mentioned in the official documentation) is when you keep the "install && build && clean" commands in a single RUN command. This matters because if you split it up over multiple layers, the earlier layers still contain all the stuff the later layers try to clean. The end result is a fat image that contains the stuff you wanted to remove in a lower layer, with whiteout entries in a higher layer, so it only looks like the files have been removed.
Quoted 3 lines
Your patch set does the right thing WRT the debian install/clean, so all good, but I thought I'd mention this because it did not come up in any discussions here or in the linked docs.
OK, so we *do* have a Docker expert, now! ;-)
Thank you for your explanations, that was very instructive. I gues that's because aufs is used underneath, or something like that?
I would have expected that, instead of implicit, a layer would have been explicit, like with a COMMIT keyword or something like that...
Anyway, it all makes sense in hindsight, indeed. Thanks!
Regards,
Yann E. MORIN.
Signature · 6 lines
.-----------------.--------------------.------------------.--------------------. | Yann E. MORIN | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: | | +33 662 376 056 | Software Designer | \ / CAMPAIGN | ___ | | +33 223 225 172 `------------.-------: X AGAINST | \e/ There is no | | http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL | v conspiracy. | '------------------------------^-------^------------------^--------------------'
PATCH 1/1 support/dockerfile: add directives to run as non-root
Quoted 13 lines · Yann E. MORIN
Cam, All,
On 2018-02-05 14:52 +1100, Cam Hutchison spake thusly:
Quoted 9 lines
Where the big win comes in (and is not mentioned in the official documentation) is when you keep the "install && build && clean" commands in a single RUN command. This matters because if you split it up over multiple layers, the earlier layers still contain all the stuff the later layers try to clean. The end result is a fat image that contains the stuff you wanted to remove in a lower layer, with whiteout entries in a higher layer, so it only looks like the files have been removed.
Quoted 5 lines
Quoted 3 lines
Your patch set does the right thing WRT the debian install/clean, so all good, but I thought I'd mention this because it did not come up in any discussions here or in the linked docs.
OK, so we *do* have a Docker expert, now! ;-)
Hah. I know enough to be dangerous, but I'm hardly an expert. I am experimenting with docker in buildroot at the moment though, so I'm sure to learn more.
Quoted 2 lines
Thank you for your explanations, that was very instructive. I gues that's because aufs is used underneath, or something like that?
Overlayfs these days, but yes. Each layer is another overlay and once a layer is made, it is immutable. Higher layers just modify the ultimate view.
Quoted 2 lines
I would have expected that, instead of implicit, a layer would have been explicit, like with a COMMIT keyword or something like that...
I've found Dockerfiles to be pretty basic really and this one layer per command stuff seems like a shortcut that was never fixed. A commit of some sort would make so much more sense. They have recently added the ability to build multiple images where only the final image is used as the output. This allows you to build up a "development" image and build an executable, and just copy that to the final image, leaving behind all the development infrastructure. That can make Dockerfiles a lot cleaner, removing the need for all the && chains.
PATCH 1/1 support/dockerfile: add directives to run as non-root
In reply to Yann E. MORINQuoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line
"Yann" == Yann E MORIN <[email protected]> writes:
Hi,
Quoted 5 lines
Quoted 3 lines
Your patch set does the right thing WRT the debian install/clean, so all good, but I thought I'd mention this because it did not come up in any discussions here or in the linked docs.
OK, so we *do* have a Docker expert, now! ;-)
;)
Quoted 7 lines
Thank you for your explanations, that was very instructive. I gues that's because aufs is used underneath, or something like that?
I would have expected that, instead of implicit, a layer would have been explicit, like with a COMMIT keyword or something like that...
Anyway, it all makes sense in hindsight, indeed. Thanks!
One more thing to keep in mind, is that Docker expects the commands to be idempotent, so docker will afaik cache each layer and reuse the cache when you rerun the dockerfile later on and not actually execute those commands:
https://thenewstack.io/understanding-the-docker-cache-for-faster-builds/
Signature · 1 line
Bye, Peter Korsgaard