heimdall2 Updated COPY commands

trafficstars

Added the built-in chmod/chown flags to improve build time. Removed standalone chmod and chown RUN commands, and removed all chmod/chown operations from the builder container. Will and I elected to keep the chmod and chown commands in the app stage of the image because they serve as a precautionary measure, and removing them makes no positive or negative impact on performance or space, and do not impact the legibility of the file.

On my machine, this improved build time from 2604 seconds to 309 - an 88 percent decrease. Pending further testing on other machines, as mine appeared to run it dramatically slower than others.

Dockerfile.lite still needs to be updated accordingly.

Feb 17 '23 18:02 catorreMC

It seems to me that this container should be running as either a heimdall user or a heimdallapp or nodeapp or something like that - and thus in the final build layer there should be commands making sure all the data on the image is owned by that user:

COPY --from=build /usr/bin/dumb-init /usr/bin/dumb-init
USER node
WORKDIR /usr/src/app
COPY --chown=node:node --from=build /usr/src/app/node_modules /usr/src/app/node_modules
COPY --chown=node:node . /usr/src/app

chmod,chwon commands can be joined and they can also be recessive. So I can chown -R user:group <path> next The files and folders on the system, I would think, only need at max: 00640 for -type f and 00750 -type d although enabling the stickly bit on all directory structures in the base layers with the right mask may save some time an effort here. However this may be showing a bug that would mean we may have to be more hands on with managing this.

https://forums.docker.com/t/permissions-issue-with-compose-build-vs-docker-build/7775

Feb 20 '23 16:02 aaronlippold

It seems to me that this container should be running as either a heimdall user or a heimdallapp or nodeapp or something like that - and thus in the final build layer there should be commands making sure all the data on the image is owned by that user:

That's why we have that 'node' user. They've basically done the work to properly create a different user account from root and we can do whatever we want with it now as opposed to having to manually create a 'heimdall' user.