opencontainers / opencontainers/image-spec

config.User in image config

Open
#784 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Go
Stars
4.5k
Forks
891
Avg merge
27d 2h
Merged PRs (30d)
1

Description

I created an oci image by following the image-spec. While converting my 'image' into a runtime-bundle using oci-image-tool convert, I received the error:

config.User: unsupported format
github.com/opencontainers/image-tools/image.runtimeSpec
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/image/config.go:103
github.com/opencontainers/image-tools/image.createBundle
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/image/image.go:342
github.com/opencontainers/image-tools/image.createRuntimeBundle
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/image/image.go:289
github.com/opencontainers/image-tools/image.CreateRuntimeBundleLayout
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/image/image.go:235
main.createAction
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/cmd/oci-image-tool/create.go:74
github.com/opencontainers/image-tools/vendor/github.com/urfave/cli.HandleAction
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/vendor/github.com/urfave/cli/app.go:485
github.com/opencontainers/image-tools/vendor/github.com/urfave/cli.Command.Run
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/vendor/github.com/urfave/cli/command.go:193
github.com/opencontainers/image-tools/vendor/github.com/urfave/cli.(*App).Run
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/vendor/github.com/urfave/cli/app.go:250
main.main
        /c/Users/mattm/repo/personal/go/src/github.com/opencontainers/image-tools/cmd/oci-image-tool/main.go:63
runtime.main
        /usr/local/go/src/runtime/proc.go:195
runtime.goexit
        /usr/local/go/src/runtime/asm_amd64.s:2337

My image config came straight from the spec's documentation with some minor changes such as the user name, home directory, etc.

{
    "schemaVersion": 2,
    "created": "2019-06-29T04:43:42.455040700Z",
    "author": "Bob T. Hacker <bobthacker@example.com>",
    "architecture": "amd64",
    "os": "linux",
    "config": {
        "User": "root",
        "ExposedPorts": {},
        "Env": [
            "PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin",
            "FOO=oci_is_a",
            "BAR=well_written_spec"
        ],
        "Entrypoint": [
            "/bin/sh"
        ],
        "Cmd": [],
        "Volumes": {},
        "WorkingDir": "/",
        "Labels": {
            "com.example.project.git.url": "https://example.com/project.git",
            "com.example.project.git.commit": "45a939b2999782a3f005621a8d0f29aa387e1d6b"
        }
    },
    "rootfs": {
        "diff_ids": [
            "sha256:ec3da7fb5f709a1ce912e6e31fccc5588420c5f1dcecc362c72c989532c1917a"
        ],
        "type": "layers"
    },
    "history": [
        {
            "created": "2019-06-29T04:43:42.455040700Z",
            "created_by": "/bin/sh -c #(nop) CMD [\"sh\"]",
            "empty_layer": true
        }
    ]
}

The code responsible for throwing the error is on lines 87-104 in the image/config.go file

	if uid, err := strconv.Atoi(c.Config.User); err == nil {
		s.Process.User.UID = uint32(uid)
	} else if ug := strings.Split(c.Config.User, ":"); len(ug) == 2 {
		uid, err := strconv.Atoi(ug[0])
		if err != nil {
			return nil, errors.New("config.User: unsupported uid format")
		}

		gid, err := strconv.Atoi(ug[1])
		if err != nil {
			return nil, errors.New("config.User: unsupported gid format")
		}

		s.Process.User.UID = uint32(uid)
		s.Process.User.GID = uint32(gid)
	} else if c.Config.User != "" {
		return nil, errors.New("config.User: unsupported format")
	}

Going by the code, I changed the config.User value to "0:0" (i.e: uid:gid) and the command oci-image-tool convert command completed successfully.

Is the documentation wrong? Are developers not supposed to enter an actual username in the config.User field?

UPDATE
After running the runtime-bundle in docker, I get the following error:

docker: Error response from daemon: linux spec user: unable to find user 0/0: no matching entries in passwd file.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the image-spec config.md documentation and image/config.go, then reproduce conversion with the shown username and 0:0 values. Compare how named users and uid:gid values are handled, including the Docker passwd-file error. Done means the specification and implementation agree, with the behavior covered by a focused test or documentation correction.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
devops, tooling
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.