feat: work with rootless docker #362
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
|
Codecov Report
@@ Coverage Diff @@
## main #362 +/- ##
=======================================
Coverage 44.65% 44.65%
=======================================
Files 51 51
Lines 1496 1496
Branches 233 233
=======================================
Hits 668 668
Misses 824 824
Partials 4 4
|
|
I just checked, docker is not even installed inside those images, so mounting docker.sock is not useful at all. |
paulpach
force-pushed
the
nodockerindocker
branch
from
1181e8f to
0c1bfc3
Compare
paulpach
changed the title
paulpach
changed the title
Running docker currently mounts the docker.sock file into the container. This was introduced in 2ab738c but there is no explanation provided. The docker.sock file is only needed if we want to run docker inside the container to create other images or start other containers. I searched through the code and I did not find any such use. In particular, on fedora this gives permission denied because docker.sock is owned by root and the container runs under an unprivileged user. One has to change the permissions of docker.sock (which is actually a link to /run/podman/podman.sock) to be writeable by the user. If we don't need to use docker inside the containers, then we can remove this file, thus we can run this GitHub action as an unprivileged user out of the box.
paulpach
force-pushed
the
nodockerindocker
branch
from
0c1bfc3 to
491c691
Compare
webbertakken
approved these changes
Mar 27, 2022
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Running docker currently mounts the docker.sock file into the container.
This was introduced in 2ab738c but
there is no explanation provided.
The docker.sock file is only needed if we want to run docker inside the container
to create other images or start other containers.
I searched through the code and I did not find any such use.
In particular, on fedora this gives permission denied because docker.sock
is owned by root and the container runs under an unprivileged user.
One has to change the permissions of docker.sock
(which is actually a link to /run/podman/podman.sock) to be writeable by the user.
If we don't need to use docker inside the containers, then we can remove this file,
thus we can run this GitHub action as an unprivileged user out of the box.
Changes
Checklist