From fa8e8ab6fb8613e39649ce9c2f47dd61797c78ed Mon Sep 17 00:00:00 2001 From: Ryan Gonzalez Date: Fri, 19 Sep 2025 16:02:13 -0500 Subject: [PATCH] docker: Fix usage with rootless podman and SELinux When using rootless podman, the *current user* gets mapped to uid 0, which results in the aptly user being unable to write to the build directory. We can instead map the current user to the corresponding uid in the container via `PODMAN_USERNS=keep-id`, which matches up with what docker-wrapper wants...but then that will *enter the container as the current uid*, which messes with the ability to set permissions on `/var/lib/aptly`. That can be fixed by explicitly passing `--user 0:0`, which should be a no-op on docker (since the container's default user is already root). Additionally, this adds `--security-opt label=disable` to avoid permission errors when running on systems with SELinux enforcing. --- Makefile | 21 ++++++++++++--------- 1 file changed, 12 insertions(+), 9 deletions(-) diff --git a/Makefile b/Makefile index 4692dfde..00293c2c 100644 --- a/Makefile +++ b/Makefile @@ -7,6 +7,9 @@ COVERAGE_DIR?=$(shell mktemp -d) GOOS=$(shell go env GOHOSTOS) GOARCH=$(shell go env GOHOSTARCH) +export PODMAN_USERNS = keep-id +DOCKER_RUN = docker run --security-opt label=disable -it --user 0:0 --rm -v ${PWD}:/work/src + # Setting TZ for certificates export TZ=UTC # Unit Tests and some sysmte tests rely on expired certificates, turn back the time @@ -173,16 +176,16 @@ docker-image-no-cache: ## Build aptly-dev docker image (no cache) @docker build --no-cache -f system/Dockerfile . -t aptly-dev docker-build: ## Build aptly in docker container - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper build + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper build docker-shell: ## Run aptly and other commands in docker container - @docker run -it --rm -p 3142:3142 -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper || true + @$(DOCKER_RUN) -p 3142:3142 aptly-dev /work/src/system/docker-wrapper || true docker-deb: ## Build debian packages in docker container - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper dpkg DEBARCH=amd64 + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper dpkg DEBARCH=amd64 docker-unit-test: ## Run unit tests in docker container (add TEST=regex to specify which tests to run) - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper \ + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper \ azurite-start \ AZURE_STORAGE_ENDPOINT=http://127.0.0.1:10000/devstoreaccount1 \ AZURE_STORAGE_ACCOUNT=devstoreaccount1 \ @@ -191,7 +194,7 @@ docker-unit-test: ## Run unit tests in docker container (add TEST=regex to spec azurite-stop docker-system-test: ## Run system tests in docker container (add TEST=t04_mirror or TEST=UpdateMirror26Test to run only specific tests) - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper \ + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper \ azurite-start \ AZURE_STORAGE_ENDPOINT=http://127.0.0.1:10000/devstoreaccount1 \ AZURE_STORAGE_ACCOUNT=devstoreaccount1 \ @@ -202,16 +205,16 @@ docker-system-test: ## Run system tests in docker container (add TEST=t04_mirro azurite-stop docker-serve: ## Run development server (auto recompiling) on http://localhost:3142 - @docker run -it --rm -p 3142:3142 -v ${PWD}:/work/src -v /tmp/cache-go-aptly:/var/lib/aptly/.cache/go-build aptly-dev /work/src/system/docker-wrapper serve || true + @$(DOCKER_RUN) -p 3142:3142 -v /tmp/cache-go-aptly:/var/lib/aptly/.cache/go-build aptly-dev /work/src/system/docker-wrapper serve || true docker-lint: ## Run golangci-lint in docker container - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper lint + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper lint docker-binaries: ## Build binary releases (FreeBSD, macOS, Linux generic) in docker container - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper binaries + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper binaries docker-man: ## Create man page in docker container - @docker run -it --rm -v ${PWD}:/work/src aptly-dev /work/src/system/docker-wrapper man + @$(DOCKER_RUN) aptly-dev /work/src/system/docker-wrapper man mem.png: mem.dat mem.gp gnuplot mem.gp