Skip to content

Commit ba400c9

Browse files
gavindidrichsengavindidrichsen
authored
Merge pull request #59 from h0tw1r3/quality-of-life
Improve container usability
2 parents fe4b8b8 + 836a52c commit ba400c9

File tree

4 files changed

+159
-3
lines changed

4 files changed

+159
-3
lines changed

‎.github/workflows/ci.yml

+76
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
name: ci
2+
3+
on:
4+
pull_request:
5+
branches:
6+
- main
7+
workflow_dispatch:
8+
9+
jobs:
10+
main:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- name: Set up QEMU
14+
uses: docker/setup-qemu-action@v3
15+
16+
- name: Checkout
17+
uses: actions/checkout@v4
18+
19+
- name: Set up Docker Buildx
20+
uses: docker/setup-buildx-action@v2
21+
22+
- name: Build PDK Container
23+
id: build
24+
uses: docker/build-push-action@v5
25+
with:
26+
context: .
27+
push: false
28+
load: true
29+
tags: puppet/pdk:${{ github.sha }}
30+
31+
- name: Test with no workspace volume
32+
run: |
33+
if docker run --rm ${{ steps.build.outputs.imageid }} --version 2>"$GITHUB_WORKSPACE/.errout" ; then
34+
echo '::error::expected an error that was not returned'
35+
exit 1
36+
fi
37+
grep -s 'error: .* is not mounted in the container.' < "$GITHUB_WORKSPACE/.errout"
38+
39+
- name: Test with a workspace volume
40+
run: |
41+
docker run --rm -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} --version 2>"$GITHUB_WORKSPACE/.errout" | grep -E '^[[:digit:]\.]+$'
42+
grep -s 'mount a volume to /cache in the container to improve performance' < "$GITHUB_WORKSPACE/.errout"
43+
44+
- name: Test create new module
45+
run: |
46+
WORKSPACE_OWNER="$(stat -c '%u:%g' .)"
47+
docker run --rm -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} new module dockertest --skip-interview
48+
if [ "${WORKSPACE_OWNER}" != "$(stat -c '%u:%g' dockertest)" ] ; then
49+
echo "::error::pdk in container failed to run with same uid and gid of host workspace"
50+
exit 1
51+
fi
52+
cd dockertest
53+
docker run --rm -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} new class test
54+
docker run --rm -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} validate
55+
docker run --rm -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} test unit
56+
57+
- name: Test running with root workspace
58+
run: |
59+
sudo cp -r dockertest roottest
60+
cd roottest
61+
docker run --rm -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} new class root
62+
63+
- name: Test running with workspace ownership not matching user
64+
run: |
65+
cd roottest
66+
if docker run --rm --user $UID:$GID -v `pwd`:/workspace ${{ steps.build.outputs.imageid }} new class root 2>"$GITHUB_WORKSPACE/.errout" ; then
67+
echo '::error::expected an error that was not returned'
68+
exit 1
69+
fi
70+
grep -s 'error: unable to write to /workspace' < "$GITHUB_WORKSPACE/.errout"
71+
72+
- name: Test deprecated /root volume
73+
run: |
74+
cd roottest
75+
docker run --rm -v `pwd`:/root ${{ steps.build.outputs.imageid }} new class toor 2>"$GITHUB_WORKSPACE/.errout"
76+
grep -s 'the /root workdir is deprecated' < "$GITHUB_WORKSPACE/.errout"

‎Dockerfile

+8-1
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,11 @@ WORKDIR /root
55
ADD install-pdk-release.sh .
66
ADD install-onceover.sh .
77
ADD pdk-release.env .
8+
COPY entrypoint.sh /.entrypoint.sh
9+
10+
RUN passwd -d root && \
11+
mkdir /cache && \
12+
chmod a+rwx /cache
813

914
RUN apt-get update && \
1015
apt-get install -y curl openssh-client && \
@@ -25,4 +30,6 @@ ENV PATH="${PATH}:/opt/puppetlabs/pdk/private/git/bin"
2530
ENV PDK_DISABLE_ANALYTICS=true
2631
ENV LANG=C.UTF-8
2732

28-
ENTRYPOINT ["/opt/puppetlabs/pdk/bin/pdk"]
33+
WORKDIR /workspace
34+
35+
ENTRYPOINT ["/.entrypoint.sh"]

‎README.md

+9-2
Original file line numberDiff line numberDiff line change
@@ -45,16 +45,23 @@ pushes all commits and tags back to this repo.
4545

4646
Finally, Docker Hub is configured to watch the this repo and build/tag new images
4747
automatically based on the branch or tag that received new commits.
48+
4849
## How to use the Image
4950

5051
Download a release from Docker Hub as detailed above. e.g.
5152

5253
```
53-
docker pull puppet/pdk
54+
docker pull puppet/pdk:latest
5455
```
5556

5657
Run it
5758

5859
```bash
59-
docker run -v /path/to/your/module:/root puppet/pdk <pdk command>
60+
docker run -v /path/to/module:/workspace puppet/pdk <pdk command>
61+
```
62+
63+
Run it with persistent pdk cache
64+
65+
```bash
66+
docker run -v /path/to/module:/workspace -v /path/to/cache:/cache puppet/pdk <pdk command>
6067
```

‎entrypoint.sh

+66
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,66 @@
1+
#!/bin/sh
2+
3+
# re-entrant script to support automatically switching to an unprivileged user
4+
# that matches the ownership of the RUN_WORKDIR (see below)
5+
6+
set -e
7+
8+
RUN_USER=pdk
9+
RUN_WORKDIR="${PWD}"
10+
11+
[ -z "${UID}" ] && UID=$(id -u)
12+
[ -z "${GID}" ] && GID=$(id -g)
13+
14+
[ "$UID" -ne 0 ] && RUNNING_NON_ROOT=1
15+
16+
# check if required path is mounted
17+
# check for deprecated /root volume
18+
if grep -sq " /root " < /proc/mounts ; then
19+
[ -z "$ENTRYPOINT_RELOAD" ] && echo >&2 "warning: the /root workdir is deprecated, use /workspace instead."
20+
RUN_WORKDIR="/root"
21+
elif ! grep -sq " ${RUN_WORKDIR} " < /proc/mounts ; then
22+
echo >&2 "error: ${RUN_WORKDIR} is not mounted in the container." ; exit 1
23+
fi
24+
25+
create_user() {
26+
if [ "$1" -gt 0 ] ; then
27+
if [ "$2" -gt 0 ] ; then
28+
su - -c "groupadd -g $2 $RUN_USER" 2>/dev/null || true
29+
fi
30+
su - -c "useradd -d /cache -u $1 -g $2 $RUN_USER ; chown $RUN_USER: /cache ; passwd -d $RUN_USER >/dev/null"
31+
fi
32+
}
33+
34+
# skip if re-running under newly created user
35+
if [ -z "$ENTRYPOINT_RELOAD" ] ; then
36+
if [ -z "$RUNNING_NON_ROOT" ] ; then
37+
UID=$(stat -c '%u' "$RUN_WORKDIR")
38+
GID=$(stat -c '%g' "$RUN_WORKDIR")
39+
[ "$UID" -eq 0 ] && RUN_USER="root"
40+
fi
41+
create_user "$UID" "$GID"
42+
# re-run with new user
43+
exec su - $RUN_USER -c "cd $RUN_WORKDIR ; ENTRYPOINT_RELOAD=1 $0 $*"
44+
exit
45+
fi
46+
47+
# sanity check supported volumes
48+
for volume in ${RUN_WORKDIR} /cache ; do
49+
if [ ! -w "$volume" ] ; then
50+
echo >&2 "error: unable to write to ${volume}. Ensure permissions are correct on the host." ; exit 1
51+
fi
52+
if ! find "$volume/." -maxdepth 1 -name '.' \( -uid "$UID" -a -perm -u+rw \) -o \( -group "$GID" -a -perm -g+rw \) -exec true {} + ; then
53+
echo >&2 "warning: pdk may not function properly with the user/group ownership or permissions on ${volume}."
54+
fi
55+
done
56+
57+
# recommend cache path is mounted
58+
if ! grep -sq " /cache " < /proc/mounts ; then
59+
echo >&2 "mount a volume to /cache in the container to improve performance."
60+
fi
61+
62+
export PATH="${PATH}:/opt/puppetlabs/pdk/private/git/bin"
63+
export PDK_DISABLE_ANALYTICS=true
64+
export LANG=C.UTF-8
65+
66+
exec /opt/puppetlabs/pdk/bin/pdk "$@"

0 commit comments

Comments
 (0)