Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Run as non-root user "pixl" where possible [force-system-test] #345

Closed
wants to merge 16 commits into from
Closed

Run as non-root user "pixl" where possible [force-system-test] #345

wants to merge 16 commits into from

Conversation

jeremyestein
Copy link
Contributor

@jeremyestein jeremyestein commented Mar 14, 2024 •
edited

Partially addresses #234 .

TODO:

  • Will have to request a user (eg. "pixl") be added on the GAE with a known UID, and fix the UID of the container user "pixl" to match it.
  • Need to document that exports directory must be writable by user "pixl"

@jeremyestein
Add non-root user "pixl" to all Dockerfiles, except postgres-derived
be27995 
ones, which use their own user.
Run as this user from the docker-compose files for the services we
control.
@jeremyestein
TEMP - a bit of debugging to investigate the setup on GITHUB actions
7116500 
when it comes to permissions and how sudo works.
@jeremyestein
More debugging
b0b0a09
@jeremyestein
more debugging
7122548
@jeremyestein
fix silly error that I'd have thought mypy should catch
6232898
@jeremyestein
need to create group first
c1c055f
@jeremyestein
Create group and user with correct IDs in images
aea2c22
@jeremyestein
Try to feed in the right variables to the build
a3b8d2d
@jeremyestein
Move to vars file
bf5705a
@jeremyestein
Pass into the pytest so it can setup the user and group
0f62671
@jeremyestein
Remove entire orthanc build caching from system test workflow because it
5cbe3ff 
seems to be doing it differently to the docker compose file, thus
missing the build args. Yuck.
@jeremyestein
More copy paste :(
cec5d70
@jeremyestein
The values from the env files are not being passed through. I think this
bb4615c 
all needs a rethink.
@jeremyestein
Why build before (with the wrong env probably) when the build script
36489aa 
does this anyway?
@jeremyestein
Just a thought - do the tests need to run as pixl now that we've changed
76efd8e 
the file ownership
@jeremyestein
Very WIP - easier to not pass this into the python at all, but we need
5ca7249 
to know where the export directory is - however this is supposed to be
made configurable at some point so will actuall be in an env var, so we
could do it this way?
@jeremyestein
Copy link
Contributor Author

This has been replaced by #400

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
1 participant
@jeremyestein