canonical / canonical/core20

move docker user/group to extrausers

Open
#72 16 comments 1 reaction 0 assignees View on GitHub
Blocked
Dominant language
Shell
Stars
27
Forks
33
Avg merge
36m
Merged PRs (30d)
1

Description

Currently the docker user/group is defined in /etc/{passwd,group},
```
$ cat /snap/core20/current/etc/passwd | grep docker
docker:x:107:113:Reserved:/nonexistent:/bin/false
$ cat /snap/core20/current/etc/group | grep docker
docker:x:113:
```

This is problematic because it means that users can never be added to the docker group and thus use the docker snap as non-root on UC20. We have this bug pre-existing on UC16/UC18 as well, but apparently moving/transitioning users from /etc/passwd to /var/lib/extrausers/passwd is very dangerous, so for UC20 we should just move this user/group before the release so we don't have to do the complicated transition for UC20.

What I tried which seemed to work is to replace the empty /var/lib/extrausers/{group,passwd} files in a built core20 snap with ones that contained the same definitions from /etc/{group,passwd} in the core20 snap right now. That unfortunately triggers https://bugs.launchpad.net/ubuntu/+source/subiquity/+bug/1881588, but after working around that, I can then manually create a user that is in the docker group and this _almost_ works but still fails because the docker snap is too naive and isn't properly checking the /var/lib/extrausers/group file when it creates it's socket, but if it did then we would be good to go.

Also note that this is originally from a customer request about being able to use the docker snap as non-root on UC18, which is a different beast, but I think since this is easy enough to fix for core20, we should do that before UC20 is released.

CC @slimjim777 @ogra1

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by comparing the docker definitions in /etc/passwd and /etc/group with the empty /var/lib/extrausers/{passwd,group} files in the built core20 snap, then review the linked subiquity issue and the docker snap's group handling. Done means a core20 user can be added to the docker group and use the docker snap without root, including correct socket creation and without breaking the UC20 transition.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, shell, ubuntu
Domain
operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.