gauge icon indicating copy to clipboard operation
gauge copied to clipboard

Ability to choose root folder where .gauge folder is created, for secure docker deployments

Open mkmurali opened this issue 4 years ago • 9 comments

Describe the bug When used in CI/CD environments via docker, its a recommended security best practice to make the root file system as read-only and mount a temporary file space to manage all intermediate files and logs. Currently when gauge is run, it creates a .gauge folder in the project directory. Need ability to mount this on /tmp space instead.

Via properties file, currently it is possible to map screenshots, reports and logs to /tmp space. But not possible to map the .gauge folder created in the project directory.

To Reproduce Steps (or project) to reproduce the behavior:

  1. Run gauge in a container with --read-only --tmpfs /tmp
  2. Run the gauge command
  3. See error that permission denied to create .gauge in project folder

Expected behavior Either via properties file or via environment variables, support specifying a different folder than project folder to create .gauge folder

Versions: Any version.

Gauge version: 1.1.6 Plugins

html-report (4.0.12) java (0.7.13) js (2.3.15) json-report (0.3.5) screenshot (0.0.1) spectacle (0.1.4)

Additional context Current work-around is to copy the project folder to /tmp space and run gauge with -d /tmp as option. But this bypasses the security of immutable executable files in the project folder like node_modules etc.

If it is not possible to specify a different root folder for .gauge folder for any reason, it may be another alternative to extend -d option that allows gauge to be run in a different folder than the project and create .gauge folder in the current working directory (where gauge is run) rather than in the project folder.

mkmurali avatar Dec 20 '20 11:12 mkmurali

Please set the GAUGE_HOME variable to use a custom location, reference https://docs.gauge.org/faqs.html?os=macos&language=javascript&ide=vscode#what-is-gauge-home

However the preferred option is to create a gauge user and setting the necessary permissions please refer this docker file https://github.com/getgauge/template-js/blob/master/Dockerfile

zabil avatar Dec 20 '20 21:12 zabil

@zabil GAUGE_HOME is only taken into effect to install global configs and plugins, but do not effect the .gauge folder created within the project root folder where current run status etc are saved. I have tried setting GAUGE_HOME with no avail.

With respect to docker container, while it is possible to create a separate user with permissions to specific folders to be able to run tests, this 1) bypasses the security that could protect executable code and 2) not always an option when running with managed services on various cloud providers (docker containers are always invoked with default protected user).

Need an option to set a different folder or skip creating that folder, as that folder appears to be primarily used with IDEs like VSCode rather.

mkmurali avatar Dec 21 '20 02:12 mkmurali

primarily used with IDEs like VSCode rather.

It's also used for

  • Gauge execution logging
  • storing screenshots (either on failure or on when gauge.screenshot is invoked)

I don't think Gauge can skip the folder. This folder is specific to a project, configuring a location might result in issues if there are multiple projects referring the same folder.

zabil avatar Dec 21 '20 08:12 zabil

I think we can make some changes, the .gauge folder is used to

  1. store metadata about the last run and failures
  2. store screenshots for the reports to pick it

(2) above is required for run, whereas (1) is primarily for authoring.

(2) is also configurable via gauge_screenshots_dir env var. However there are a couple of issues I note.

This command should avoid the .gauge dependency completely:

save_execution_result=false gauge_screenshots_dir=/tmp/foo/screenshots gauge run specs --skip-save

I notice that there are two issues here:

  1. even when gauge_screenshots_dir is set, gauge attempts to create .gauge/screenshots. This shouldn't be the case

  2. the failures.json is created always and neither save_execution_result env var, nor --skip-save are honoured.

I think if the above two issues are addressed, it should enable this use case. Whether .gauge folder needs to be configurable can be a separate debate IMO.

sriv avatar Dec 21 '20 11:12 sriv

@sriv I think (1) and (2) will definitely help to move forward for container use cases.

@zabil I understand your concern with multiple projects. .gauge folder can be still be created at the root of the project by default, not to impact any of those use cases. But having an option to make that configurable, just like all other folders (logs, reports and screenshots), help to use gauge in many other use cases.

Appreciate any inputs in this regard. Happy to fork it away and PR to make this change, if this doesn't break too many things.

Our team has been working on few wrappers to make anybody in team write code-less acceptance test cases with Gauge.

  • Common steps implemented with Taiko, so anybody can write most common tests without coding background via https://github.com/softrams/gauge-taiko-steps
  • Bring the entire environment to author test cases to browser, so non-developers can easily approach writing and running test cases via https://github.com/softrams/automation-toolset

As e2e tests tend to be slower, we have started building a distributed engine that can take each spec file and run in a separate lambda/aws batch container to greatly speed up things. With this approach, we can bring down the time it takes to run a test suite to close to the longest spec file.

mkmurali avatar Dec 21 '20 13:12 mkmurali

Appreciate any inputs in this regard. Happy to fork it away and PR to make this change, if this doesn't break too many things.

That will be great. Ideally a flag GAUGE_METADATA_DIR that defaults to .gauge

zabil avatar Dec 21 '20 14:12 zabil

any update on this?

jbadeau avatar Feb 11 '21 20:02 jbadeau

Has there been any update on this feature? Currently working on a project where I would like to change the location of the .gauge folder.

Logan-Skippy avatar Nov 12 '21 19:11 Logan-Skippy

Sorry @jbadeau @Logan-Skippy no updates yet. @mkmurali - do you think you'd be able to spare some time to submit a PR (if you are still interested in this, that is)

sriv avatar Nov 21 '21 10:11 sriv