keybase / keybase/client

Docker does not run with `keybase` user

Open
#24,355 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
9.2k
Forks
1.3k
Avg merge
12h 58m
Merged PRs (30d)
56

Description

Keybase service fails to start when run with non-root user (and keybase fs commands don't work when run as root user).

Run Output:

USER@HOST$
USER@HOST$ docker run --rm -it -e KEYBASE_SERVICE=1 -u keybase:keybase keybaseio/client:stable keybase id
2020-10-24T07:55:13.454789Z ▶ [DEBU keybase globals.go:284] 001 Unable to init GUI log file open /home/keybase/.cache/keybase/Keybase.app.log: permission denied
2020-10-24T07:55:13.454853Z ▶ [DEBU keybase globals.go:273] 002 Unable to getLogger open /home/keybase/.cache/keybase/keybase.kbfs.perf.log: permission denied
2020-10-24T07:55:13.454880Z ▶ [DEBU keybase globals.go:606] 003 Created Identify2Cache, max age: 5m0s
2020-10-24T07:55:13.454913Z ▶ [DEBU keybase globals.go:609] 004 Created LinkCache, max size: 4000, clean dur: 1m0s
2020-10-24T07:55:13.454932Z ▶ [DEBU keybase globals.go:611] 005 Created CardCache, max age: 5m0s
2020-10-24T07:55:13.454948Z ▶ [DEBU keybase globals.go:629] 006 made a new full self cache
2020-10-24T07:55:13.454998Z ▶ [DEBU keybase globals.go:631] 007 made a new cached UPAK loader (timeout=10m0s)
2020-10-24T07:55:13.458555Z ▶ [INFO kbfs init.go:503] 008 KBFS version 5.5.1-20200527204930+39ca0071e5
2020-10-24T07:55:13.458587Z ▶ [WARN kbfs init.go:506] 009 Failed to setup log file "/home/keybase/.cache/keybase/keybase.kbfs.log": open /home/keybase/.cache/keybase/keybase.kbfs.log: permission denied
kbfsfuse error: (1) open /home/keybase/.cache/keybase/keybase.kbfs.log: permission denied
2020-10-24T07:55:13.556014Z ▶ [DEBU keybase globals.go:829] 001 GlobalContext#Shutdown(0xc00083c000)
2020-10-24T07:55:13.556242Z ▶ [DEBU keybase globals.go:831] 002 GlobalContext#Shutdown(0xc00083c000)
2020-10-24T07:55:13.556309Z ▶ [DEBU keybase globals.go:872] 003 executing 7 shutdown hooks; errCount=0
2020-10-24T07:55:13.556352Z ▶ [DEBU keybase team_member_count_cache.go:42] 004 TeamMemberCountCache shutdown
2020-10-24T07:55:13.556428Z ▶ [DEBU keybase tracker_loader.go:61] 005 + TrackerLoader.Shutdown
2020-10-24T07:55:13.556516Z ▶ [DEBU keybase tracker_loader.go:36] 006 - TrackerLoader.Shutdown -> ok [time=7.604µs]
2020-10-24T07:55:13.556595Z ▶ [DEBU keybase wallet_state.go:78] 007 WalletState shutting down
2020-10-24T07:55:13.556672Z ▶ [DEBU keybase wallet_state.go:83] 008 waiting for background refresh requests to finish
2020-10-24T07:55:13.556899Z ▶ [DEBU keybase wallet_state.go:386] 009 WalletState.backgroundRefresh: stop channel closed, stopping the loop [tags:WABR=CL9lonuHS8OA]
2020-10-24T07:55:13.557139Z ▶ [DEBU keybase wallet_state.go:90] 00a WalletState shut down complete
2020-10-24T07:55:13.557382Z ▶ [DEBU keybase globals.go:876] 00b executed shutdown hooks; errCount=0
2020-10-24T07:55:13.557463Z ▶ [DEBU keybase network_instrumenter.go:108] 00c + DiskInstrumentationStorage: Stop
2020-10-24T07:55:13.557543Z ▶ [DEBU keybase globals.go:879] 00d - DiskInstrumentationStorage: Stop -> ok [time=4.054µs]
2020-10-24T07:55:13.557618Z ▶ [DEBU keybase network_instrumenter.go:108] 00e + DiskInstrumentationStorage: Stop
2020-10-24T07:55:13.557680Z ▶ [DEBU keybase globals.go:883] 00f - DiskInstrumentationStorage: Stop -> ok [time=2.636µs]
2020-10-24T07:55:13.557747Z ▶ [DEBU keybase srv.go:184] 010 kbhttp.Srv: server died: http: Server closed
2020-10-24T07:55:13.557822Z ▶ [DEBU keybase identify3.go:212] 011 identify3State#runExpireThread: exiting on shutdown
2020-10-24T07:55:13.557989Z ▶ [DEBU keybase globals.go:901] 012 exiting shutdown code=0; errCount=0; firstErr=<nil>
2020-10-24T07:55:13.558063Z ▶ [ERRO keybase main.go:87] 013 open /home/keybase/.cache/keybase/keybase.service.log: permission denied
▶ ERROR service failed to startup: context deadline exceeded
USER@HOST$
USER@HOST$ docker run --rm -it -u keybase:keybase keybaseio/client:stable ls -alh /home/keybase
total 32K
drwxr-xr-x 1 keybase keybase 4.0K Oct 24 08:04 .
drwxr-xr-x 1 root    root    4.0K May 27 20:51 ..
-rw-r--r-- 1 keybase keybase  220 Apr 18  2019 .bash_logout
-rw-r--r-- 1 keybase keybase 3.5K Apr 18  2019 .bashrc
drwxr-xr-x 3 root    root    4.0K Oct 24 08:04 .cache
drwxr-xr-x 3 root    root    4.0K Oct 24 08:04 .config
-rw-r--r-- 1 keybase keybase  807 Apr 18  2019 .profile
USER@HOST$
USER@HOST$ cat Dockerfile
FROM keybaseio/client:stable
RUN useradd --create-home myuser

USER@HOST$ docker build -t keybase:local .
Sending build context to Docker daemon  28.67kB
Step 1/2 : FROM keybaseio/client:stable
 ---> 828396dbe50f
Step 2/2 : RUN useradd --create-home myuser
 ---> Using cache
 ---> 30afa85d8ce3
Successfully built 30afa85d8ce3
Successfully tagged keybase:local
USER@HOST$
USER@HOST$ docker run --rm -it -e KEYBASE_SERVICE=1 -u myuser:myuser keybase:local keybase id
Installing autostart file. Manage autostart settings with `keybase ctl autostart`.
2020-10-24T07:56:06.504062Z ▶ [DEBU keybase globals.go:606] 001 Created Identify2Cache, max age: 5m0s
2020-10-24T07:56:06.504120Z ▶ [DEBU keybase globals.go:609] 002 Created LinkCache, max size: 4000, clean dur: 1m0s
2020-10-24T07:56:06.504148Z ▶ [DEBU keybase globals.go:611] 003 Created CardCache, max age: 5m0s
2020-10-24T07:56:06.504170Z ▶ [DEBU keybase globals.go:629] 004 made a new full self cache
2020-10-24T07:56:06.504215Z ▶ [DEBU keybase globals.go:631] 005 made a new cached UPAK loader (timeout=10m0s)
▶ ERROR Login required: to identify without specifying a user assertion
USER@HOST$
USER@HOST$

I suspect the issue is because of the VOLUME addition at the time of docker build, which makes the owner of these directories as root at runtime:
https://github.com/keybase/client/blob/cac9573e33f472fcb1417c1e6a899bfbba36405c/packaging/linux/docker/standard/Dockerfile#L54

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Inspect packaging/linux/docker/standard/Dockerfile at the referenced line and reproduce the permission errors with the docker run commands in the report. The issue is done when the Keybase service and keybase fs commands work for a non-root user without permission errors in the home directories.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker
Domain
devops
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.