Scuba doesn't work with images that have USER set

[JonathonReinhart]

No description provided.

[mpdude]

I've been trying to use:

image: none

aliases:
    yarn:
        image: node:12-alpine
        script: yarn install

Which results in scubainit: GID 1000 already exists in /etc/group.

Is this the same issue?

[mpdude]

nodejs/docker-node#289 seems related as well.

[JonathonReinhart]

Here's one way that Scuba fails if you try to run it with an image that has USER set:

docker: Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "/.scuba/scubainit": stat /.scuba/scubainit: permission denied: unknown.

I'm guessing this is because Docker changes UID to the given USER before it tries to exec scubainit, which in this case, is inaccessible because /.scuba is 700:

jrreinhart@113a76961813:/tmp/scubademo$ ls -al /.scuba
total 84
drwx------ 2 jrreinhart primarygroup  4096 Sep  6 18:31 .
drwxr-xr-x 1 root       root          4096 Sep  6 18:31 ..
-rw-r--r-- 1 jrreinhart primarygroup    40 Sep  6 18:31 command.sh
-rwxr-xr-x 1 jrreinhart primarygroup 71104 Sep  6 18:08 scubainit

Why is it 700? Well tempfile.mkdtemp(prefix="TESTING") (as used in __make_scubadir) results in a mkdir("/temp/TESTINGxxxxxxxx", 0700) syscall. So maybe it's always been this way.

Scuba should probably just inspect the image prior to running, and throw its hands up if USER is set.

cc @rpasek

[JonathonReinhart]

There are a few ways scuba can fail when running an image with USER set:

• Running scuba normally:

  • If run from a directory beneath /home/$USER:

    scubainit: Failed to chmod /home/jreinhart: Operation not permitted
    

    • The directory already existed and owned by root (part of the path to the bind mount), but we're trying to chmod it (running as USER).
    • It turns out this is a bug (Invoking scuba with pwd at or above /home/$USER (on the host) will chmod it to 0700  #219)!

  • If run from a directory outside of /home/$USER:

    scubainit: Failed to create /home/jreinhart: Permission denied
    

    • We're trying to create a directory in /home (owned by root as part of the image), while running as USER.