bazel: cockroachdb/bazel Docker image shouldn't run builds as root
#66162
Assignees
Labels
A-build-system
C-enhancement
Solution expected to add code/behavior + preserve backward-compat (pg compat issues are exception)
Comments
rickystewart
added
C-enhancement
rickystewart
added a commit
to rickystewart/cockroach
that referenced
this issue
Jun 8, 2021
Adopt the same `autouseradd` script that we use in `cockroachdb/builder` to avoid creating these files as `root`. Also step down the permissions on some files that `bazci` creates -- they don't need to be so permissive any more. Consuming this for dev scenarios is a follow-up task -- I plan to integrate it with the `dev` helper tool. Closes cockroachdb#66162 Release note: None
craig bot
pushed a commit
that referenced
this issue
Jun 9, 2021
66105: sql: remove MaybeUpgradeDependentOldForeignKeyVersionTables r=postamar a=ajwerner We should not need this anymore. At restore time we still upgrade the representation. All descriptors in the system should use the new format. Release note: None 66197: bazel: bazel builder image doesn't run builds as root r=rail a=rickystewart Adopt the same `autouseradd` script that we use in `cockroachdb/builder` to avoid creating these files as `root`. Also step down the permissions on some files that `bazci` creates -- they don't need to be so permissive any more. Consuming this for dev scenarios is a follow-up task -- I plan to integrate it with the `dev` helper tool. Closes #66162 Release note: None 66205: sqlproxyccl: do not inject error frame after connection hand off r=JeffSwenson a=JeffSwenson Fixes #66156 Previously, deny list and idle errors were communicated using error frames. This causes wire protocol corruption if the proxy is in the middle of proxying a reply frame. Now, the sqlproxy closes the connection without injecting an error frame. Communicating errors to the client after connection handoff could be done if the proxy inspects the reply stream and tracks the start/end of database reply frames. Release note: None 66207: build: quash remaining references to `msan` r=rail a=rickystewart This is no longer supported. Release note: None Co-authored-by: Andrew Werner <[email protected]> Co-authored-by: Ricky Stewart <[email protected]> Co-authored-by: Jeff Swenson <[email protected]>
rickystewart
added a commit
to rickystewart/cockroach
that referenced
this issue
Aug 27, 2021
Adopt the same `autouseradd` script that we use in `cockroachdb/builder` to avoid creating these files as `root`. Also step down the permissions on some files that `bazci` creates -- they don't need to be so permissive any more. Consuming this for dev scenarios is a follow-up task -- I plan to integrate it with the `dev` helper tool. Closes cockroachdb#66162 Release note: None Release justification:
|
I did more investigation into making this work. I have a draft at my fork, commit
I did some investigation and determined that this folder
I don't have a workaround for this so we're still blocked. Notably both of these issues are macOS-only. This wouldn't be a problem if we primarily had to support Linux. |
rickystewart
added a commit
to rickystewart/cockroach
that referenced
this issue
Aug 31, 2021
Adopt the same `autouseradd` script that we use in `cockroachdb/builder` to avoid creating these files as `root`. Also step down the permissions on some files that `bazci` creates -- they don't need to be so permissive any more. Closes cockroachdb#66162 Release note: None Release justification: Non-production code change
craig bot
pushed a commit
that referenced
this issue
Sep 1, 2021
69203: storage: update min version with store cluster version r=sumeerbhola a=jbowens Whenever the store cluster version key is updated, update the minimum storage version too. Fix #69116. Release note: None 69641: server: add SQL STATS COMPACTION to automatic job list r=maryliag,arulajmani,ajwerner a=Azhng Previously, SQL STATS COMPACTION job was not marked as automatic job. This means SQL STATS COMPACTION job would show up in the Jobs Page in DB Console and in the output of SHOW JOBS. This commit adds SQL STATS COMPACTION to a list of automatic jobs (e.g. auto table stats). This means SQL STATS COMPACTION job information would only be present in the output of SHOW AUTOMATIC JOBS. Release justification: Bug fixes and low-risk updates to new functionality Release note (sql change): SQL STATS COMPACTION job now only shows up in the output of SHOW AUTOMATIC JOBS. 69651: colexec: fix IN operator with unsorted tuple r=mgartner a=mgartner The vectorized implementation of an `element IN tuple` expression assumes that the contents of `tuple` are sorted by the optimizer. Based on this assumption, it performs a binary search instead of a linear search. However, the assumption that the optimizer sorts all tuples is incorrect. For example, there are cases where the contents of a tuple are not known at planning-time, so the tuple cannot be sorted. Performing a binary search with an unsorted tuple causes incorrect query results. Now, the vectorized engine sorts tuple contents if they are not already sorted. Fixes #68979 Release justification: This commit fixes a bug with the IN operator that causes incorrect results. Release note (bug fix): A bug has been fixed which caused incorrect evaluation of the `IN` operator when the tuple on the right-hand-side of the operator included a subquery, like `a IN ('foo', (SELECT s FROM t), 'bar')`. 69666: bazel: bazel builder image doesn't run builds as root r=jlinder a=rickystewart Adopt the same `autouseradd` script that we use in `cockroachdb/builder` to avoid creating these files as `root`. Also step down the permissions on some files that `bazci` creates -- they don't need to be so permissive any more. Closes #66162 Release justification: Non-production code change Release note: None 69681: sql: apply zone configs for copied INDEX for ALTER PK on RBR tables r=ajwerner a=otan Release justification: bug fix for existing feature Release note (bug fix): Previously, when using ALTER PRIMARY KEY on a REGIONAL BY ROW table, the copied unique index from the old PRIMARY KEY would not have the correct zone configurations applied. This commit fixes that. Users who encountered this bug should re-create the index. Co-authored-by: Jackson Owens <[email protected]> Co-authored-by: Azhng <[email protected]> Co-authored-by: Marcus Gartner <[email protected]> Co-authored-by: Ricky Stewart <[email protected]> Co-authored-by: Oliver Tan <[email protected]>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
We should adopt the same strategy we use in the
cockroachdb/builderimage to run builds as a non-root user so that generated artifacts aren't owned byroot.My naive attempt at doing this is breaking the build for some reason:
The text was updated successfully, but these errors were encountered: