Skip to content

Commit

Permalink
fix: mount ssh socket with rw so that non-root users can make use of …
Browse files Browse the repository at this point in the history 
…it (#63)

* fix: mount ssh socket with rw so that non-root users can make use of it

* fix: correct test

* fix: correct test

* fix: correct test
  • Loading branch information
@jithine
jithine authored Feb 18, 2021
1 parent 59056fb commit 668622c
Show file tree
Hide file tree
Showing 2 changed files with 9 additions and 7 deletions.
2 changes: 1 addition & 1 deletion launch/docker.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -99,7 +99,7 @@ func (d *docker) runBuild(buildEntry buildEntry) error {
binVol := fmt.Sprintf("%s:%s", d.volume, "/opt/sd")
habVol := fmt.Sprintf("%s:%s", d.habVolume, "/opt/sd/hab")

dockerVolumes := append(d.localVolumes, srcVol, artVol, binVol, habVol, fmt.Sprintf("%s:/tmp/auth.sock", d.socketPath))
dockerVolumes := append(d.localVolumes, srcVol, artVol, binVol, habVol, fmt.Sprintf("%s:/tmp/auth.sock:rw", d.socketPath))

// Overwrite steps for sd-local interact mode. The env will load later.
if d.interactiveMode {
Expand Down
14 changes: 8 additions & 6 deletions launch/docker_test.go
View file
Original file line number Diff line number Diff line change
Expand Up @@ -15,6 +15,8 @@ import (
"github.com/stretchr/testify/assert"
)

var sshSocket = os.Getenv("SSH_AUTH_SOCK") + ":/tmp/auth.sock:rw"

const (
fakeProcessLifeTime = 100 * time.Second
waitForKillTime = 100 * time.Millisecond
Expand Down Expand Up @@ -158,12 +160,12 @@ func TestRunBuild(t *testing.T) {
{"success", "SUCCESS_RUN_BUILD", nil,
[]string{
"docker pull node:12",
fmt.Sprintf("docker container run --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s:/tmp/auth.sock -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, os.Getenv("SSH_AUTH_SOCK"))},
fmt.Sprintf("docker container run --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, sshSocket)},
newBuildEntry()},
{"success with memory limit", "SUCCESS_RUN_BUILD", nil,
[]string{
"docker pull node:12",
fmt.Sprintf("docker container run -m2GB --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s:/tmp/auth.sock -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, os.Getenv("SSH_AUTH_SOCK"))},
fmt.Sprintf("docker container run -m2GB --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, sshSocket)},
newBuildEntry(func(b *buildEntry) {
b.MemoryLimit = "2GB"
})},
Expand Down Expand Up @@ -210,12 +212,12 @@ func TestRunBuildWithSudo(t *testing.T) {
{"success", "SUCCESS_RUN_BUILD_SUDO", nil,
[]string{
"sudo docker pull node:12",
fmt.Sprintf("sudo docker container run --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s:/tmp/auth.sock -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, os.Getenv("SSH_AUTH_SOCK"))},
fmt.Sprintf("sudo docker container run --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, sshSocket)},
newBuildEntry()},
{"success with memory limit", "SUCCESS_RUN_BUILD_SUDO", nil,
[]string{
"sudo docker pull node:12",
fmt.Sprintf("sudo docker container run -m2GB --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s:/tmp/auth.sock -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, os.Getenv("SSH_AUTH_SOCK"))},
fmt.Sprintf("sudo docker container run -m2GB --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /opt/sd/local_run.sh ", d.volume, d.habVolume, sshSocket)},
newBuildEntry(func(b *buildEntry) {
b.MemoryLimit = "2GB"
})},
Expand Down Expand Up @@ -264,13 +266,13 @@ func TestRunBuildWithInteractiveMode(t *testing.T) {
{"success", "SUCCESS_RUN_BUILD_INTERACT", nil,
[]string{
"sudo docker pull node:12",
fmt.Sprintf("sudo docker container run -itd --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s:/tmp/auth.sock -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /bin/sh", d.volume, d.habVolume, os.Getenv("SSH_AUTH_SOCK")),
fmt.Sprintf("sudo docker container run -itd --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /bin/sh", d.volume, d.habVolume, sshSocket),
"sudo docker attach "},
newBuildEntry()},
{"success with memory limit", "SUCCESS_RUN_BUILD_INTERACT", nil,
[]string{
"sudo docker pull node:12",
fmt.Sprintf("sudo docker container run -m2GB -itd --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s:/tmp/auth.sock -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /bin/sh", d.volume, d.habVolume, os.Getenv("SSH_AUTH_SOCK")),
fmt.Sprintf("sudo docker container run -m2GB -itd --rm -v /:/sd/workspace/src/screwdriver.cd/sd-local/local-build -v sd-artifacts/:/test/artifacts -v %s:/opt/sd -v %s:/opt/sd/hab -v %s -e SSH_AUTH_SOCK=/tmp/auth.sock node:12 /bin/sh", d.volume, d.habVolume, sshSocket),
"sudo docker attach SUCCESS_RUN_BUILD_INTERACT"},
newBuildEntry(func(b *buildEntry) {
b.MemoryLimit = "2GB"
Expand Down

0 comments on commit 668622c

Please sign in to comment.