-
Notifications
You must be signed in to change notification settings - Fork 171
Use appropriate user in CI to avoid permissions errors on later runs #4545
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
base: release
Are you sure you want to change the base?
Conversation
@JHopeCollins don't bother reviewing. Needs more thought. |
|
||
# UNDO ME | ||
docker: | ||
name: Build developer Docker containers | ||
uses: ./.github/workflows/docker.yml | ||
with: | ||
tag: connorjwardtest-dev-${{ github.base_ref }} | ||
branch: ${{ github.base_ref }} | ||
build_dev: true | ||
secrets: inherit |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
# UNDO ME | |
docker: | |
name: Build developer Docker containers | |
uses: ./.github/workflows/docker.yml | |
with: | |
tag: connorjwardtest-dev-${{ github.base_ref }} | |
branch: ${{ github.base_ref }} | |
build_dev: true | |
secrets: inherit |
@JHopeCollins I think that this is ready to go now. If you have time please give this a review. The changes look daunting but the core change is we now build the Linux containers inside an |
This should fix the permissions issues that we saw building Docker images on CI.
The issue was that the regular CI runs are run in a Docker container as the root user and this means that if a job is cancelled then a bunch of files are left behind that are owned by
root
. If we subsequently build a Docker image on the same runner we would crash because that workflow is run as an unprivileged user.I tried to make the regular CI runs use an unprivileged user but I don't think that it is possible. Instead the solution I've found here is to build the Docker images inside another container, and hence as root.