aws / aws/aws-cdk

nodejsfunction/bundling: files bundled via Docker should be owned by the running user

Open
#32,834 1 comment 0 reactions 0 assignees View on GitHub
@aws-cdk/aws-codebuild @aws-cdk/aws-lambda-nodejs @aws-cdk/core feature-request help wanted p2
Dominant language
TypeScript
Stars
12.9k
Forks
4.6k
Avg merge
2d 3h
Merged PRs (30d)
83

Description

### Describe the feature

When running a bundling command in Docker (for example using `NodejsFunction`, but also other commands that do bundling in a Docker container), the generated files will be owned by whatever user the Docker daemon is running as.

### Use Case

On MacOS, the Docker Desktop daemon is typically running as the user, and so files generated from bundling will be owned by the user, which is good.

On Linux, the Docker daemon is typically running as `root`, and so files generated from bundling will be owned by `root`. This means they cannot be cleaned up afterwards! This is a huge hassle, and has cost me a week debugging build failures on GitHub Actions.

> The problem does not exhibit on CodeBuild, because on CodeBuild the user running the CDK CLI is `root`; but on GitHub Actions there is a specific `runner` user, distinct from `root`... and it is not allowed to touch files created by `root`.

### Proposed Solution

`chown()` in the container will work, and the uids are the same between container and host (if I understand the situation correctly).

It's just that the container will most likely not have access to the host system's user database.

What we should do is to pass the current process' `uid` into the container, and inside the container `chown` all the files it created to the right `uid`. I'm like 90% confident this should work 😅 .

This should probably be implemented as part of the generic "run a bundling command in Docker" feature; it shows most commonly through the `NodejsFunction` construct, but that should not be the place to fix it. It applies to all Docker bundling commands.

Also, someone needs to go figure out what the story on Windows is, because I have no idea.

### Other Information

_No response_

### Acknowledgements

- [ ] I may be able to implement this feature request
- [ ] This feature might incur a breaking change

### CDK version used

-

### Environment details (OS name and version, etc.)

-

Contributor guide

Open the contributing guide

Research direction

Begin with the generic Docker bundling entry point rather than NodejsFunction, which the issue identifies as an example. Check how the current process UID could be passed into the container and how generated files are cleaned up, including the unresolved Windows behavior. Done means Docker-bundled files can be removed by the invoking user on Linux without breaking other bundling commands.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, typescript
Domain
build-system, devops
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.