Failing because EACCES since static-web-apps-deploy uses Docker with root
- Dominant language
- No language data
- Stars
- 346
- Forks
- 67
- PR merge metrics
- No merged PRs in 30d
Description
This is the weirdest thing that is happening, when using static-web-apps-deploy the `api` folder in self-hosted github runner, is always `root`, this happens when I don't skip the build for static-web-apps-deploy. and let oryx do its building. But as soon as I say skip api build, the folders are not changed, still `mmansour`. As soon as I allow the runner to build `API` it messes up the permissions causing my whole self-hosted agent to fail the next time it runs:
```
Error: File was unable to be removed Error: EACCES: permission denied, unlink '/home/mmansour/actions-runner/_work/app/app/api/.funcignore'
```
My monitoring the syscalls in the Github Action,
```
time->Wed Sep 20 22:12:57 2023
type=PROCTITLE msg=audit(1695273177.138:52877): proctitle=6D6B646972002D70002E6F7279785F70726F645F6E6F64655F6D6F64756C6573
type=PATH msg=audit(1695273177.138:52877): item=1 name=".oryx_prod_node_modules" inode=23231831 dev=fd:01 mode=040755 ouid=0 ogid=0 rdev=00:00 nametype=CREATE cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=PATH msg=audit(1695273177.138:52877): item=0 name="/github/workspace/api" inode=23231945 dev=fd:01 mode=040755 ouid=1000 ogid=1000 rdev=00:00 nametype=PARENT cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1695273177.138:52877): cwd="/github/workspace/api"
type=SYSCALL msg=audit(1695273177.138:52877): arch=c000003e syscall=83 success=yes exit=0 a0=7fff41c1f8f5 a1=1ff a2=0 a3=fffffffffffffd8c items=2 ppid=1619239 pid=1619685 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="mkdir" exe="/bin/mkdir" subj=docker-default key="api-watch"
```
The uuid and guid is 0 which is root, and `ls -al` the solution:
```
drwxr-xr-x 12 mmansour mmansour 4096 Sep 20 22:12 .
drwxr-xr-x 3 mmansour mmansour 4096 Sep 20 21:32 ..
drwxr-xr-x 7 root root 4096 Sep 20 22:12 api
drwxr-xr-x 4 mmansour mmansour 4096 Sep 20 22:12 dist
drwxr-xr-x 8 mmansour mmansour 4096 Sep 20 22:13 .git
drwxr-xr-x 3 mmansour mmansour 4096 Sep 20 22:12 .github
-rw-r--r-- 1 mmansour mmansour 39 Sep 20 22:12 .gitignore
drwxr-xr-x 12 mmansour mmansour 4096 Sep 20 22:12 node_modules
-rw-r--r-- 1 mmansour mmansour 2498 Sep 20 22:12 package.json
-rw-r--r-- 1 mmansour mmansour 215312 Sep 20 22:12 pnpm-lock.yaml
drwxr-xr-x 2 mmansour mmansour 4096 Sep 20 22:12 public
-rw-r--r-- 1 mmansour mmansour 1714 Sep 20 22:12 README.md
drwxr-xr-x 7 mmansour mmansour 4096 Sep 20 22:12 src
```
It is chowning all the `/api` folder to be owned by root:
```
----
time->Wed Sep 20 22:12:58 2023
type=PROCTITLE msg=audit(1695273178.714:58159): proctitle=63686F776E002D5200726F6F743A726F6F74002F6769746875622F776F726B73706163652F617069
type=PATH msg=audit(1695273178.714:58159): item=0 name="types.d.ts.map" inode=23343409 dev=fd:01 mode=0100644 ouid=0 ogid=0 rdev=00:00 nametype=NORMAL cap_fp=0 cap_fi=0 cap_fe=0 cap_fver=0 cap_frootid=0
type=CWD msg=audit(1695273178.714:58159): cwd="/github/workspace/api/.oryx_prod_node_modules"
type=SYSCALL msg=audit(1695273178.714:58159): arch=c000003e syscall=260 success=yes exit=0 a0=9 a1=5633dff02298 a2=0 a3=0 items=1 ppid=1619239 pid=1619703 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="chown" exe="/bin/chown" subj=docker-default key="api-watch"
----
```
How can we tell that Github Action `static-web-apps-deploy` to run as a certain user and not root? (my alias is mmansour in msft if we can talk there too)
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.