eve
eve copied to clipboard
lf-edge
compose-image: run yq container as root
The yq container assumes that user id is 1000. Which is true for most of the systems, but not for all of them. The obvious example is a shared machine, where only the first user will have uid 1000.
As the result the development build (DEV=y) will work only for uid 1000, and for other users yq will silently fail to update the rootfs yaml configuration.
This patch adds a missing check that yq was successful, so the build will fail if it was not. And also fixes the problem by running yq container as root, so it has necessary permissions to edit the yaml
Signed-off-by: Yuri Volchkov [email protected]
Why would we want to run yq as root? It shouldn't require any privileges at all, it is just processing input text to output text.
Adding error check is a good thing (although wouldn't just running the entire script with set -e do it?). Writing the file should be done as a redirect to avoid permissions issues.
YQ container would not have rights to write to the mounted directory if it is not owned by UID 1000. The way it is done now is updating resulting file inplace. I'll check if its possible to redirect the stdout of container to the file
As for set -e it is considered as a bad practice. I'd prefer not to do that
http://mywiki.wooledge.org/BashFAQ/105
As for set -e it is considered as a bad practice. I'd prefer not to do that
I disagree. I understand that it is incomplete, but so is every piece of technology ever written. If there are situations that need specific addressing, then let's do that. In the case you are trying to solve, it makes your pain go away.
I'll check if its possible to redirect the stdout of container to the file
That would be a lot cleaner, if it is possible. Writing stuff from within a container to be used outside it works, but creates lots of permissions headaches (as you pointed out).
[the hostess took up a broom] @zededa-yuri do you plan to check if it's possible to redirect the stdout to a file and finish this pr or we can close it?
Create OCI config for lfedge/eve-pillar-dev:dd25be30132b23fba5b71a153e9b5f7fdb02e5a6-amd64
Works fine for me!
