Docker builds with uid/gid 0 (root)

[05nelsonm]

Describe the bug
When building native binaries via make native-all, output directories in /target have root user permissions (uid 0, gid 0) resulting in build error Permission denied

To Reproduce

1. From linux environment, run make native-all
2. Check directory permissions after build fails

Expected behavior
building via dockcross should utilize the user id and group id from the shell of the user executing it such that their output matches that of the user.

e.g.

// Makefile

U_ID:="$(shell id -u)"
G_ID:="$(shell id -g)"

// For all other architectures as shown in attached image
linux64: $(SQLITE_UNPACKED) jni-header
	docker run $(DOCKER_RUN_OPTS) -u "$(U_ID):$(G_ID)" .......

Logs

mkdir: cannot create directory 'target/classes/org/sqlite/native/Linux-Musl/aarch64': Permission denied
make: *** [Makefile:125: src/main/resources/org/sqlite/native/Linux-Musl/aarch64/libsqlitejdbc.so] Error 1
make: *** [Makefile:162: linux-musl-arm64] Error 2

Environment (please complete the following information):

• OS:

  $ cat /etc/os-release
  NAME="Pop!_OS"
  VERSION="22.04 LTS"
  ID=pop
  ID_LIKE="ubuntu debian"
  PRETTY_NAME="Pop!_OS 22.04 LTS"
  VERSION_ID="22.04"
  HOME_URL="https://pop.system76.com"
  SUPPORT_URL="https://support.system76.com"
  BUG_REPORT_URL="https://github.com/pop-os/pop/issues"
  PRIVACY_POLICY_URL="https://system76.com/privacy"
  VERSION_CODENAME=jammy
  UBUNTU_CODENAME=jammy
  LOGO=distributor-logo-pop-os
  

• CPU architecture: x86_64
• sqlite-jdbc version: 3.43.0.0

Additional context

[gotson]

If you already have a fix feel free to send a PR.

[05nelsonm]

freebsd32 and freebsd64 use docker image empterdose/freebsd-cross-build:9.3 and are unable to specify an unprivileged user via option -u $(U_ID):$(G_ID).

From the README it says bumping to 11.4 will allow the ability to specify a user. Thoughts on bumping it to 11.4, or would that be an issue?

These 2 builds are the only ones that are unhappy.

EDIT: empterdose docker images aren't really working b/c of the need to install bash, openjdk8 and perl, which can't be done when specifying a user (locked). Also getting errors env: can't execute bash: No such file or directory

Unsure what to do other than to build and use a different image.

[gotson]

@michael-o knows about freebsd much more than I do, and may advise on supporting only v11+.

It seems the empterdose image has been updated and supports aarch64 now, which would allow to drop my own fork.

[gotson]

empterdose docker images aren't really working b/c of the need to install bash, openjdk8 and perl, which can't be done when specifying a user (locked). Also getting errors env: can't execute bash: No such file or directory

Those should be installable with sudo, even when running the container with an unprivileged user, no?

[michael-o]

@gotson Let me try to understand the issue and how I can help here.

[michael-o]

First of all note:

• Update to 12.4 with clang MrDOS/freebsd-cross-build#1
• Upgrade FreeBSD cross image fusesource/jansi#257

I'd first update and then retry and see results. 9.3 is very old now (2016-12-31).

[gotson]

@05nelsonm are you able to clarify why the original issue of having directories / files owned by root is a problem?

It's been like this for some time, and never has been a problem for anyone. Is that because your build system differs in some ways?

We even build all native libs on github actions without any issues.

[05nelsonm]

@05nelsonm are you able to clarify why the original issue of having directories / files owned by root is a problem?

It's been like this for some time, and never has been a problem for anyone. Is that because your build system differs in some ways?

Yes I am building on laptop from non-root user (user id 1000) and kept running into build errors related to permissions resulting in the inability to copy files >> Permission denied.

Have everything building now with the proper user id:group id, except the freebsd* binaries, and the build is successful.

We even build all native libs on github actions without any issues.

Yes the container for GH actions is fine b/c it's user id:group id is 0:0 (i.e. root)

In general, running docker as root is ill-advised.

First of all note:

• Update to 12.4 with clang MrDOS/freebsd-cross-build#1
• Upgrade FreeBSD cross image fusesource/jansi#257

I'd first update and then retry and see results. 9.3 is very old now (2016-12-31).

Looking into it now

[michael-o]

Briefly looking at the issue and the output (don't attach screenshots, they are horrible) it does not specificly apply to FreeBSD, but on how the actual container is run. I still would try to upgrade to 11.4 first and see if the error exist. Doesn't make sense to analyse an old image's behavior, no?

[05nelsonm]

Briefly looking at the issue and the output (don't attach screenshots, they are horrible) it does not specificly apply to FreeBSD, but on how the actual container is run. I still would try to upgrade to 11.4 first and see if the error exist. Doesn't make sense to analyse an old image's behavior, no?

Yes I've tried updating to new version and adding --user $(U_ID):$(G_ID), but freebsd complains because it is unable to install dependencies (non-root user). Will try some other images.

[michael-o]

Briefly looking at the issue and the output (don't attach screenshots, they are horrible) it does not specificly apply to FreeBSD, but on how the actual container is run. I still would try to upgrade to 11.4 first and see if the error exist. Doesn't make sense to analyse an old image's behavior, no?

Yes I've tried updating to new version and adding --user $(U_ID):$(G_ID), but freebsd complains. Will try some other images.

What is the exact output? I bet that the source user does not exist in the container, how can it?

[05nelsonm]

What is the exact output? I bet that the source user does not exist in the container, how can it?

The --user ... command is a docker thing, it will automatically run using that uid:gid. The issue is with alpine linux which the freebsd containers are based on, and the inability to execute apk add <lib>. So, it exits with error as it is unable to find bash or perl from that user.