Docker does not run with `keybase` user
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 9.2k
- Forks
- 1.3k
- Avg merge
- 12h 58m
- Merged PRs (30d)
- 56
Description
Keybase service fails to start when run with non-root user (and keybase fs commands don't work when run as root user).
Run Output:
USER@HOST$
USER@HOST$ docker run --rm -it -e KEYBASE_SERVICE=1 -u keybase:keybase keybaseio/client:stable keybase id
2020-10-24T07:55:13.454789Z ▶ [DEBU keybase globals.go:284] 001 Unable to init GUI log file open /home/keybase/.cache/keybase/Keybase.app.log: permission denied
2020-10-24T07:55:13.454853Z ▶ [DEBU keybase globals.go:273] 002 Unable to getLogger open /home/keybase/.cache/keybase/keybase.kbfs.perf.log: permission denied
2020-10-24T07:55:13.454880Z ▶ [DEBU keybase globals.go:606] 003 Created Identify2Cache, max age: 5m0s
2020-10-24T07:55:13.454913Z ▶ [DEBU keybase globals.go:609] 004 Created LinkCache, max size: 4000, clean dur: 1m0s
2020-10-24T07:55:13.454932Z ▶ [DEBU keybase globals.go:611] 005 Created CardCache, max age: 5m0s
2020-10-24T07:55:13.454948Z ▶ [DEBU keybase globals.go:629] 006 made a new full self cache
2020-10-24T07:55:13.454998Z ▶ [DEBU keybase globals.go:631] 007 made a new cached UPAK loader (timeout=10m0s)
2020-10-24T07:55:13.458555Z ▶ [INFO kbfs init.go:503] 008 KBFS version 5.5.1-20200527204930+39ca0071e5
2020-10-24T07:55:13.458587Z ▶ [WARN kbfs init.go:506] 009 Failed to setup log file "/home/keybase/.cache/keybase/keybase.kbfs.log": open /home/keybase/.cache/keybase/keybase.kbfs.log: permission denied
kbfsfuse error: (1) open /home/keybase/.cache/keybase/keybase.kbfs.log: permission denied
2020-10-24T07:55:13.556014Z ▶ [DEBU keybase globals.go:829] 001 GlobalContext#Shutdown(0xc00083c000)
2020-10-24T07:55:13.556242Z ▶ [DEBU keybase globals.go:831] 002 GlobalContext#Shutdown(0xc00083c000)
2020-10-24T07:55:13.556309Z ▶ [DEBU keybase globals.go:872] 003 executing 7 shutdown hooks; errCount=0
2020-10-24T07:55:13.556352Z ▶ [DEBU keybase team_member_count_cache.go:42] 004 TeamMemberCountCache shutdown
2020-10-24T07:55:13.556428Z ▶ [DEBU keybase tracker_loader.go:61] 005 + TrackerLoader.Shutdown
2020-10-24T07:55:13.556516Z ▶ [DEBU keybase tracker_loader.go:36] 006 - TrackerLoader.Shutdown -> ok [time=7.604µs]
2020-10-24T07:55:13.556595Z ▶ [DEBU keybase wallet_state.go:78] 007 WalletState shutting down
2020-10-24T07:55:13.556672Z ▶ [DEBU keybase wallet_state.go:83] 008 waiting for background refresh requests to finish
2020-10-24T07:55:13.556899Z ▶ [DEBU keybase wallet_state.go:386] 009 WalletState.backgroundRefresh: stop channel closed, stopping the loop [tags:WABR=CL9lonuHS8OA]
2020-10-24T07:55:13.557139Z ▶ [DEBU keybase wallet_state.go:90] 00a WalletState shut down complete
2020-10-24T07:55:13.557382Z ▶ [DEBU keybase globals.go:876] 00b executed shutdown hooks; errCount=0
2020-10-24T07:55:13.557463Z ▶ [DEBU keybase network_instrumenter.go:108] 00c + DiskInstrumentationStorage: Stop
2020-10-24T07:55:13.557543Z ▶ [DEBU keybase globals.go:879] 00d - DiskInstrumentationStorage: Stop -> ok [time=4.054µs]
2020-10-24T07:55:13.557618Z ▶ [DEBU keybase network_instrumenter.go:108] 00e + DiskInstrumentationStorage: Stop
2020-10-24T07:55:13.557680Z ▶ [DEBU keybase globals.go:883] 00f - DiskInstrumentationStorage: Stop -> ok [time=2.636µs]
2020-10-24T07:55:13.557747Z ▶ [DEBU keybase srv.go:184] 010 kbhttp.Srv: server died: http: Server closed
2020-10-24T07:55:13.557822Z ▶ [DEBU keybase identify3.go:212] 011 identify3State#runExpireThread: exiting on shutdown
2020-10-24T07:55:13.557989Z ▶ [DEBU keybase globals.go:901] 012 exiting shutdown code=0; errCount=0; firstErr=<nil>
2020-10-24T07:55:13.558063Z ▶ [ERRO keybase main.go:87] 013 open /home/keybase/.cache/keybase/keybase.service.log: permission denied
▶ ERROR service failed to startup: context deadline exceeded
USER@HOST$
USER@HOST$ docker run --rm -it -u keybase:keybase keybaseio/client:stable ls -alh /home/keybase
total 32K
drwxr-xr-x 1 keybase keybase 4.0K Oct 24 08:04 .
drwxr-xr-x 1 root root 4.0K May 27 20:51 ..
-rw-r--r-- 1 keybase keybase 220 Apr 18 2019 .bash_logout
-rw-r--r-- 1 keybase keybase 3.5K Apr 18 2019 .bashrc
drwxr-xr-x 3 root root 4.0K Oct 24 08:04 .cache
drwxr-xr-x 3 root root 4.0K Oct 24 08:04 .config
-rw-r--r-- 1 keybase keybase 807 Apr 18 2019 .profile
USER@HOST$
USER@HOST$ cat Dockerfile
FROM keybaseio/client:stable
RUN useradd --create-home myuser
USER@HOST$ docker build -t keybase:local .
Sending build context to Docker daemon 28.67kB
Step 1/2 : FROM keybaseio/client:stable
---> 828396dbe50f
Step 2/2 : RUN useradd --create-home myuser
---> Using cache
---> 30afa85d8ce3
Successfully built 30afa85d8ce3
Successfully tagged keybase:local
USER@HOST$
USER@HOST$ docker run --rm -it -e KEYBASE_SERVICE=1 -u myuser:myuser keybase:local keybase id
Installing autostart file. Manage autostart settings with `keybase ctl autostart`.
2020-10-24T07:56:06.504062Z ▶ [DEBU keybase globals.go:606] 001 Created Identify2Cache, max age: 5m0s
2020-10-24T07:56:06.504120Z ▶ [DEBU keybase globals.go:609] 002 Created LinkCache, max size: 4000, clean dur: 1m0s
2020-10-24T07:56:06.504148Z ▶ [DEBU keybase globals.go:611] 003 Created CardCache, max age: 5m0s
2020-10-24T07:56:06.504170Z ▶ [DEBU keybase globals.go:629] 004 made a new full self cache
2020-10-24T07:56:06.504215Z ▶ [DEBU keybase globals.go:631] 005 made a new cached UPAK loader (timeout=10m0s)
▶ ERROR Login required: to identify without specifying a user assertion
USER@HOST$
USER@HOST$
I suspect the issue is because of the VOLUME addition at the time of docker build, which makes the owner of these directories as root at runtime:
https://github.com/keybase/client/blob/cac9573e33f472fcb1417c1e6a899bfbba36405c/packaging/linux/docker/standard/Dockerfile#L54
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Inspect packaging/linux/docker/standard/Dockerfile at the referenced line and reproduce the permission errors with the docker run commands in the report. The issue is done when the Keybase service and keybase fs commands work for a non-root user without permission errors in the home directories.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker
- Domain
- devops
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 45/100