Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: Specify uid for consistent uids over images #4304

Open
wants to merge 11 commits into
base: main
Choose a base branch
from
+11 −9
Open

chore: Specify uid for consistent uids over images #4304

Changes from 9 commits
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
6da77d8
chore: Specify uid for consistent uids over images
kvanzuijlen Mar 1, 2024
2bab703
chore: Make Atlantis system user on Debian
kvanzuijlen Mar 1, 2024
55691cf
chore: Changed uid to 100
kvanzuijlen Mar 1, 2024
51416cb
Merge branch 'main' into patch-1
jamengual Mar 8, 2024
a1d739c
chore: Added another user with uid 1000
kvanzuijlen Mar 11, 2024
3f1134c
Merge remote-tracking branch 'origin/patch-1' into patch-1
kvanzuijlen Mar 11, 2024
36e2e19
Merge branch 'main' into patch-1
jamengual Mar 27, 2024
f5c3b4f
Merge branch 'main' into patch-1
kvanzuijlen Mar 28, 2024
4a509dc
Merge branch 'main' into patch-1
jamengual Apr 2, 2024
3a8196b
chore: Pinned gid as well
kvanzuijlen Apr 2, 2024
4489774
Merge branch 'main' into patch-1
jamengual Apr 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 9 additions & 8 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,7 +44,13 @@ RUN --mount=type=cache,target=/go/pkg/mod \
--mount=type=cache,target=/root/.cache/go-build \
CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X 'main.version=${ATLANTIS_VERSION}' -X 'main.commit=${ATLANTIS_COMMIT}' -X 'main.date=${ATLANTIS_DATE}'" -v -o atlantis .

FROM debian:${DEBIAN_TAG} as debian-base
FROM debian:${DEBIAN_TAG} AS debian-base

# Set up the 'atlantis' user and adjust permissions. User with uid 1000 is for backwards compatibility
RUN useradd --uid 100 --system --create-home --user-group --shell /bin/bash atlantis && \
useradd --uid 1000 --system --home=/home/atlantis/ --groups atlantis --shell /bin/bash atlantis2 && \
kvanzuijlen marked this conversation as resolved.
Show resolved Hide resolved
chown atlantis:atlantis /home/atlantis/ && \
chmod ug+rwx /home/atlantis/
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The whole Atlantis group has the same access as the Atlantis user. I added an atlantis2 user with uid 1000 for backward compatibility. The root group is no longer included in the chown, but that shouldn't matter too much as the group had the same permissions as other. Only in cases where end-users configured a user that is part of the root group and changed the permissions on this folder would this be a breaking change, which I think is an acceptable scenario.


# Install packages needed to run Atlantis.
# We place this last as it will bust less docker layer caches when packages update
Expand All @@ -64,7 +70,7 @@ RUN apt-get update && \
apt-get clean && \
rm -rf /var/lib/apt/lists/*

FROM debian-base as deps
FROM debian-base AS deps

# Get the architecture the image is being built for
ARG TARGETPLATFORM
Expand Down Expand Up @@ -140,7 +146,7 @@ HEALTHCHECK --interval=5m --timeout=3s \

# Set up the 'atlantis' user and adjust permissions
RUN addgroup atlantis && \
adduser -S -G atlantis atlantis && \
adduser -u 100 -S -G atlantis atlantis && \
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We need to discuss this.
We need to keep backward compatibility or make the breaking change.
A lot of people is already using this and if we change it it could bring some deployments down

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@GMartinez-Sisti @nitrocode @GenPage

Copy link
Contributor

@jamengual jamengual Mar 1, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The atlantis user does not need a shell to start, so a system user was used.
the problem is that in Alpine we have a different UUID

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see what you mean. But not making it equal makes it harder to make the helm chart work for both. The helm chart defaults to 100 so that was what we were trying to ensure here.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not saying this is wrong but changing it will break backwards compatibility

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

A possible option is to add both users (100 and 1000) on debian. This way the helm chart will be correct and existing users won't have issues. Otherwise we will need to do a breaking change release indeed. Thoughts?

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

that could work

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Looks like two maintainers agreed, so I'd say let's go with this. @kvanzuijlen can you please update it?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sounds good! I'll have a look

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is for alpine and should stay on 100, as it already was the default

chown atlantis:root /home/atlantis/ && \
chmod u+rwx /home/atlantis/

Expand Down Expand Up @@ -179,11 +185,6 @@ EXPOSE ${ATLANTIS_PORT:-4141}
HEALTHCHECK --interval=5m --timeout=3s \
CMD curl -f http://localhost:${ATLANTIS_PORT:-4141}/healthz || exit 1

# Set up the 'atlantis' user and adjust permissions
RUN useradd --create-home --user-group --shell /bin/bash atlantis && \
chown atlantis:root /home/atlantis/ && \
chmod u+rwx /home/atlantis/

# copy atlantis binary
COPY --from=builder /app/atlantis /usr/local/bin/atlantis
# copy terraform binaries
Expand Down
Loading