move docker user/group to extrausers
- Dominant language
- Shell
- Stars
- 27
- Forks
- 33
- Avg merge
- 36m
- Merged PRs (30d)
- 1
Description
Currently the docker user/group is defined in /etc/{passwd,group},
```
$ cat /snap/core20/current/etc/passwd | grep docker
docker:x:107:113:Reserved:/nonexistent:/bin/false
$ cat /snap/core20/current/etc/group | grep docker
docker:x:113:
```
This is problematic because it means that users can never be added to the docker group and thus use the docker snap as non-root on UC20. We have this bug pre-existing on UC16/UC18 as well, but apparently moving/transitioning users from /etc/passwd to /var/lib/extrausers/passwd is very dangerous, so for UC20 we should just move this user/group before the release so we don't have to do the complicated transition for UC20.
What I tried which seemed to work is to replace the empty /var/lib/extrausers/{group,passwd} files in a built core20 snap with ones that contained the same definitions from /etc/{group,passwd} in the core20 snap right now. That unfortunately triggers https://bugs.launchpad.net/ubuntu/+source/subiquity/+bug/1881588, but after working around that, I can then manually create a user that is in the docker group and this _almost_ works but still fails because the docker snap is too naive and isn't properly checking the /var/lib/extrausers/group file when it creates it's socket, but if it did then we would be good to go.
Also note that this is originally from a customer request about being able to use the docker snap as non-root on UC18, which is a different beast, but I think since this is easy enough to fix for core20, we should do that before UC20 is released.
CC @slimjim777 @ogra1
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by comparing the docker definitions in /etc/passwd and /etc/group with the empty /var/lib/extrausers/{passwd,group} files in the built core20 snap, then review the linked subiquity issue and the docker snap's group handling. Done means a core20 user can be added to the docker group and use the docker snap without root, including correct socket creation and without breaking the UC20 transition.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, shell, ubuntu
- Domain
- operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100