-
Notifications
You must be signed in to change notification settings - Fork 1
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
#77: fix permissions setup of mounted volumes
change log: - add docker-entrypoint.sh that dynamically ensures container has read/write permissions at runtime while using a non-root user to run applications - update Dockerfile to user docker-entrypoint.sh - update setup.sh to remove redundant setup_permissions and improve env var readability
- Loading branch information
Showing
4 changed files
with
172 additions
and
101 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,72 @@ | ||
| #!/bin/bash | ||
| # SPDX-License-Identifier: Apache-2.0 | ||
| # | ||
| # SPDX-FileCopyrightText: © 2024 Tenstorrent AI ULC | ||
|
|
||
| # Docker entry point script: | ||
| # ensures CONTAINER_APP_USERNAME has read/write permissions to: | ||
| # - CACHE_ROOT | ||
| # - /home/${CONTAINER_APP_USERNAME} | ||
| # | ||
| # This script is run by container root user at startup, CMD is then deescalated | ||
| # to non-root user CONTAINER_APP_USERNAME. | ||
| # Note: for additional run-time mounted volumes, mount them as leaf to | ||
| # /home/${CONTAINER_APP_USERNAME}/ if read/write permissions are needed. | ||
|
|
||
| set -eo pipefail | ||
|
|
||
| set_group_permissions() { | ||
| local var_dir="$1" | ||
| local shared_group="$2" | ||
| echo "setting permissions for ${var_dir} ..." | ||
|
|
||
| # Skip if directory doesn't exist | ||
| if [ ! -d "$var_dir" ]; then | ||
| return 0 | ||
| fi | ||
|
|
||
| # Check current group and permissions | ||
| current_group=$(stat -c "%G" "$var_dir") | ||
| current_perms=$(stat -c "%a" "$var_dir") | ||
|
|
||
| # Set group if needed | ||
| if [ "$current_group" != "$shared_group" ]; then | ||
| chown -R :"$shared_group" "$var_dir" | ||
| fi | ||
|
|
||
| # Set permissions if needed | ||
| if [ "$current_perms" != "2775" ]; then | ||
| chmod -R 2775 "$var_dir" | ||
| fi | ||
| } | ||
|
|
||
| echo "using CACHE_ROOT: ${CACHE_ROOT}" | ||
|
|
||
| # Get current ownership of volume | ||
| VOLUME_OWNER=$(stat -c '%u' "$CACHE_ROOT") | ||
| VOLUME_GROUP=$(stat -c '%g' "$CACHE_ROOT") | ||
| echo "Mounted CACHE_ROOT volume is owned by UID:GID - $VOLUME_OWNER:$VOLUME_GROUP" | ||
|
|
||
| # Create shared group with host's GID if it doesn't exist | ||
| if ! getent group "$VOLUME_GROUP" > /dev/null 2>&1; then | ||
| groupadd -g "$VOLUME_GROUP" sharedgroup | ||
| fi | ||
|
|
||
| # Get the created/existing group name | ||
| SHARED_GROUP_NAME=$(getent group "$VOLUME_GROUP" | cut -d: -f1) | ||
|
|
||
| # Add container user to the shared group | ||
| usermod -a -G "$SHARED_GROUP_NAME" "${CONTAINER_APP_USERNAME}" | ||
|
|
||
| # Ensure new files get group write permissions (in current shell) | ||
| umask 0002 | ||
|
|
||
| # Process CACHE_ROOT if it's not inside home directory | ||
| if [[ "$CACHE_ROOT" != "/home/${CONTAINER_APP_USERNAME}"* ]]; then | ||
| set_group_permissions "$CACHE_ROOT" "$SHARED_GROUP_NAME" | ||
| fi | ||
| set_group_permissions "/home/${CONTAINER_APP_USERNAME}" "$SHARED_GROUP_NAME" | ||
| echo "Mounted volume permissions setup completed." | ||
|
|
||
| # Execute CMD as CONTAINER_APP_USERNAME user | ||
| exec gosu "${CONTAINER_APP_USERNAME}" "$@" |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.