asciidoctor-diagram in combination with plantuml creates a ? directory in source directory

[sdavids]

$ mkdir -p /tmp/test && cd "$_"
$ mkdir src build
$ cat << 'EOF' >src/test.adoc
[plantuml]
----
@startuml

label Test

@enduml
----
EOF
$ tree -a --noreport /tmp/test
/tmp/test
├── build
└── src
    └── test.adoc
$ docker run \
  --rm \
  -u "$(id -u):$(id -g)" \
  -v '/tmp/test/src:/documents' \
  -v '/tmp/test/build:/mnt/build' \
  asciidoctor/docker-asciidoctor:1.76.0 \
  sh -c 'asciidoctor-pdf -D /mnt/build -r asciidoctor-diagram test.adoc'
Fontconfig error: No writable cache directories
...
$ tree -a --noreport /tmp/test
/tmp/test
├── build
│   ├── .asciidoctor
│   │   └── diagram
│   │       └── diag-plantuml-md5-e44a8461ee81fc745bd01cef0a04d9dc.png.cache
│   ├── diag-plantuml-md5-e44a8461ee81fc745bd01cef0a04d9dc.png
│   └── test.pdf
└── src
    ├── ?
    │   └── .java
    │       └── fonts
    │           └── 17.0.12
    │               └── fcinfo-1-ddfe350edc90-Alpine Linux-3.20.3-en-US.properties
    └── test.adoc

Notice the creation of the src/? directory.

I am not sure if it is a side-effect of #470.

Regardless, this directory should be created somewhere else so one can mount the src directory as readonly:

$ docker run \
  --rm \
  -u "$(id -u):$(id -g)" \
  -v '/tmp/test/src:/documents:ro' \
  -v '/tmp/test/build:/mnt/build' \
  asciidoctor/docker-asciidoctor:1.76.0 \
  sh -c 'asciidoctor-pdf -D /mnt/build -r asciidoctor-diagram test.adoc'

[sdavids]

Even when setting XDG_CACHE_HOME (see #470 (comment)) the src/? directory is still created.

So this has to be configured somewhere else.

$ mkdir -p /tmp/test && cd "$_"
$ mkdir src build
$ cat << 'EOF' >src/test.adoc
[plantuml]
----
@startuml

label Test

@enduml
----
EOF
$ docker run \
  --rm \
  -u "$(id -u):$(id -g)" \
  -v '/tmp/test/src:/documents' \
  -v '/tmp/test/build:/mnt/build' \
  -e XDG_CACHE_HOME=/tmp \
  asciidoctor/docker-asciidoctor:1.76.0 \
  sh -c 'asciidoctor-pdf -D /mnt/build -r asciidoctor-diagram test.adoc'
$ tree -a --noreport /tmp/test
/tmp/test
├── build
│   ├── .asciidoctor
│   │   └── diagram
│   │       └── diag-plantuml-md5-e44a8461ee81fc745bd01cef0a04d9dc.png.cache
│   ├── diag-plantuml-md5-e44a8461ee81fc745bd01cef0a04d9dc.png
│   └── test.pdf
└── src
    ├── ?
    │   └── .java
    │       └── fonts
    │           └── 17.0.12
    │               └── fcinfo-1-a3cb5d7b7654-Alpine Linux-3.20.3-en-US.properties
    └── test.adoc

[sdavids]

$ echo "$(id -u):$(id -g)"
502:20
$  docker run --rm -u "$(id -u):$(id -g)" asciidoctor/docker-asciidoctor:1.76.0 whoami
whoami: unknown uid 502

$ docker run --rm -v '/tmp/test/src:/documents' -e XDG_CACHE_HOME=/tmp asciidoctor/docker-asciidoctor:1.76.0 sh -c 'adduser -D test && su -c "asciidoctor-pdf -r asciidoctor-diagram test.adoc" -- test && ls -AR /home/test'
/home/test:
.java

/home/test/.java:
fonts

/home/test/.java/fonts:
17.0.12

/home/test/.java/fonts/17.0.12:
fcinfo-1-1d1cec97232f-Alpine Linux-3.20.3-en-US.properties

So apparently asciidoctor-diagram/plantUML/JDK has to be configured somehow to not write in $HOME but in some other place.

[jandelgado]

It seems that Java uses /etc/passwd to lookup the users homedir and does not consult the HOME environment variable. Since we pass -u "$(id -u):$(id -g)" to docker run, there will be most probable no entry in /etc/passwd. Java then seems to come up with ? as the homedir. My workaround is to start the container with --env _JAVA_OPTIONS="-Duser.home=/tmp" (in addition to --env XDG_CACHE_HOME=/tmp/.cache).

[sdavids]

A disadvantage of your workaround is the message "Picked up _JAVA_OPTIONS: -Duser.home=/tmp" being written to stderr.

There is not easy way to get rid of it:

https://superuser.com/questions/585695/suppressing-the-picked-up-java-options-message

[sdavids]

Opened an issue upstream: asciidoctor/asciidoctor-diagram#485

[jandelgado]

Yes, the message is annoying. But at least the ? direcory is gone now. Another option is to mount /etc/passwd in the container. This is how I call docker-asciidoctor from a makefile

docker run --rm -t -u "$(shell id -u):$(shell id -g)" \
                 -v $(PWD):/documents/ -v /etc/passwd:/etc/passwd:ro \
                 --env XDG_CACHE_HOME=/tmp/.cache \
                asciidoctor/docker-asciidoctor:${ASCIIDOC_VERSION} .....

[sdavids]

From a security standpoint I suggest not to mount your host's /etc/passwd directly.

Rather, retrieve the /etc/passwd from the container, append a new user, and then mount that file—something similar to:

passwd_file="some/path"

docker run --rm \
  "asciidoctor/docker-asciidoctor:${ASCIIDOC_VERSION}" cat /etc/passwd >"${passwd_file}"

echo "$(whoami):x:$(id -u):$(id -g):Docker User:/nonexistent:/usr/bin/false" >>"${passwd_file}"

docker run \
    --mount "type=bind,source=$(realpath "${passwd_file}"),target=/etc/passwd,readonly" \
...