aws / aws/aws-cdk

@aws-cdk/aws-lambda-python-alpha: Docker build does not work with podman.

Open
#32,092 3 comments 1 reaction 0 assignees View on GitHub
@aws-cdk/aws-lambda-python bug effort/medium p3
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the bug

When the aws-cdk.lambda-python-alpha package uses a container to package up a layer it passes in parameters that are not needed with podman (due to it running as the user).

Thus the CLI that is generated when prepping a layer looks like this.
```sh
docker run --rm \
-u "501:20" \
-v "/Users/urkle/Projects/Netfor/CDK/netfor-cdk/smp_lambdas/src/layer_google:/asset-input:delegated" \
-v "/Users/urkle/Projects/Netfor/CDK/netfor-cdk/cdk.out/asset.2b2e755e90bc7b0c887c1688b8b6d93ed65c286ed49bca0f6425b999735a9b09:/asset-output:delegated" \
-w "/asset-input" cdk-de18f6cee13cbafcdf0bad83fb66063b89b266a182dd361054851531a4bed9a0 \
bash -c "rsync -rLv /asset-input/ /asset-output/python && cd /asset-output/python && python -m pip install -r requirements.txt -t /asset-output/python"
```

However, the user mapping `-u 501:20` causes issues with podman and causes permission denied errors for the script.

Removing that mapping allows the script to work.

Further when running in that mode the output folder ( `asset.2b2e755e90bc7b0c887c1688b8b6d93ed65c286ed49bca0f6425b999735a9b09` ) does not need to be world writable (777).

Related #31319

### Regression Issue

- [ ] Select this option if this issue appears to be a regression.

### Last Known Working CDK Version

_No response_

### Expected Behavior

The CDK process works. (and podman is becoming more common especially with the unfriendly licenses of Docker Desktop)

### Current Behavior

Error from the rsync command when running with -u "501:20"

```
ERROR: Could not open requirements file: [Errno 13] Permission denied: 'requirements.txt'
```

### Reproduction Steps

PythonLayerVersion(
self,
'CustomLayer',
entry=scriptPath('src/layer'),
compatible_runtimes=[_lambda.Runtime.PYTHON_3_11],
)

### Possible Solution

Allow for specifying/detecting `podman` vs `docker` so differing behaviors can be applied

### Additional Information/Context

_No response_

### CDK CLI Version

2.166.0

### Framework Version

_No response_

### Node.js Version

18.16.1

### OS

macOS 12.7.6

### Language

Python

### Language Version

3.11

### Other information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start from the aws-cdk.lambda-python-alpha container packaging path and reproduce the generated docker run command with Podman using the provided PythonLayerVersion example. The work is done when layer packaging succeeds with Podman without the incompatible user mapping or permission errors, while preserving the existing Docker behavior.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, python, typescript
Domain
build-system, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.