DiamondLightSource / DiamondLightSource/python-copier-template

rootful is broken

Aperta
#217 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub
devcontainer
Lingua principale
Jinja
Stelle
25
Fork
10
Merge medio
4h 4m
PR unite (30g)
6

Descrizione

If you use the python copier template developer container and you have docker (or rootful podman) then it does not work as intended:

- GOOD: it loads and you can work on the project and run tests
- BAD: massively insecure as you are running as true root
- UGLY: project files get written by root and the git gets really angry

There used to be a workaround to this in devcontainer.json
```json
"remoteUser": "${localEnv:VSCODE_REMOTE_USER}"
```

docker users were then expected to set VSCODE_REMOTE_USER=$(id -u):$(id -g) in their bashrc.
podman users need do nothing as blank == default == root which is just right in a a rootless container.

Not ideal. But it was the best I could come up with.

Guida per i contributori

Apri la guida per i contributori

Direzione di ricerca

Start with the devcontainer.json configuration in the Python Copier template and reproduce the behavior using Docker or rootful Podman. Compare the current container user handling with the former VSCODE_REMOTE_USER workaround; done should mean the container remains usable without running as true root or leaving project files owned by root.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Valutazione

Stack tecnologico
docker, python
Ambito
developer-experience, devops
Tipo di issue
Bug
Difficoltà
3/5
Tempo stimato
1-2 giorni
Stato di attività
Ferma
Chiarezza
Da chiarire
Idoneità per principianti
30/100

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.