Docker user inconsistent when using GitHub Action

[perezd]

I have a simple Golang-based docker container, nothing special, looks like this:

ARG VARIANT="1.19-bullseye"
FROM mcr.microsoft.com/vscode/devcontainers/go:0-${VARIANT}

ARG NODE_VERSION="none"
RUN if [ "${NODE_VERSION}" != "none" ]; \
    then su vscode -c "umask 0002 && . /usr/local/share/nvm/nvm.sh && nvm install ${NODE_VERSION} 2>&1"; fi

RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
    && apt-get -y install --no-install-recommends openjdk-11-jdk wget bat

RUN wget https://www.antlr.org/download/antlr-4.11.1-complete.jar -O /usr/local/lib/antlr.jar
RUN echo "#/bin/sh" > /usr/local/bin/antlr && \
    echo "java -Xmx500M -cp /usr/local/lib/antlr.jar org.antlr.v4.Tool \$@" >> /usr/local/bin/antlr && \
    chmod +x /usr/local/bin/antlr

USER vscode
RUN go install github.com/josharian/impl@latest && \
    go install github.com/cweill/gotests/gotests@latest && \
    go install github.com/fatih/gomodifytags@latest && \
    go install github.com/haya14busa/goplay/cmd/goplay@latest && \
    go install github.com/go-delve/delve/cmd/dlv@latest && \
    go install honnef.co/go/tools/cmd/staticcheck@latest && \
    go install golang.org/x/tools/gopls@latest

My devcontainer.json looks like this:

{
	"name": "MyProject",
	"build": {
		"dockerfile": "Dockerfile",
		"args": {
			"VARIANT": "1.19-bullseye",
			"NODE_VERSION": "18"
		}
	},
	"runArgs": [
		"--cap-add=SYS_PTRACE",
		"--security-opt",
		"seccomp=unconfined"
	],
	"customizations": {
		"vscode": {
			"settings": {
				"go.toolsManagement.checkForUpdates": "local",
				"go.useLanguageServer": true,
				"go.installDependenciesWhenBuilding": true,
				"go.gopath": "/go"
			},
			"extensions": [
				"mike-lischke.vscode-antlr4",
				"golang.Go",
			]
		}
	},
	"remoteUser": "vscode",
	"features": {}
}

Notice that the user is vscode. Locally, if I built this container and run ls -l /go/pkg/mod, I see something like this:

drwxr-sr-x 3 vscode golang 4096 Oct 25 03:21 cache
drwxr-sr-x 8 vscode golang 4096 Oct 25 03:21 github.com
drwxr-sr-x 3 vscode golang 4096 Oct 25 03:21 golang.org

Notice the vscode user is properly named as the owner. Everything working as expected.
Now, If I do the very same thing w/ the GitHub Action, I see this:

drwxr-sr-x  3 1000 golang 4096 Oct 25 03:44 cache
drwxr-sr-x 22 1000 golang 4096 Oct 25 03:44 github.com
drwxr-sr-x  3 1000 golang 4096 Oct 25 03:44 golang.org

Here the username is 1000, and my runCmd to go test -v ./... results in a bunch of permission denied errors.

  go: writing go.mod cache: open /go/pkg/mod/cache/download/github.com/fatih/color/@v/v1.13.0.mod298498081.tmp: permission denied
  go: writing go.mod cache: mkdir /go/pkg/mod/cache/download/github.com/iancoleman: permission denied
  go: writing go.mod cache: open /go/pkg/mod/cache/download/github.com/inconshreveable/mousetrap/@v/v1.0.1.mod427131847.tmp: permission denied
  go: writing go.mod cache: mkdir /go/pkg/mod/cache/download/github.com/antlr: permission denied
  go: writing go.mod cache: open /go/pkg/mod/cache/download/github.com/mattn/go-colorable/@v/v0.1.13.mod939984059.tmp: permission denied
  go: writing go.mod cache: open /go/pkg/mod/cache/download/github.com/mattn/go-isatty/@v/v0.0.16.mod911902081.tmp: permission denied
  go: writing go.mod cache: open /go/pkg/mod/cache/download/github.com/spf13/cobra/@v/v1.5.0.mod474941318.tmp: permission denied
  go: writing go.mod cache: open /go/pkg/mod/cache/download/golang.org/x/exp/@v/v0.0.0-20221006183845-316c7553db56.mod140954425.tmp: permission denied
  go: writing go.mod cache: open /go/pkg/mod/cache/download/golang.org/x/sys/@v/v0.0.0-20221006211917-84dc82d7e875.mod336122540.tmp: permission denied
  go: writing go.mod cache: mkdir /go/pkg/mod/cache/download/github.com/ivanpirog: permission denied

I verified that the container built by this github action believes it is correctly logged in as the vscode user, but this file system seems to not be consistent with what I am producing locally when VSCode builds this container.

Am I doing something wrong? This feels like a bug, it should be otherwise fully reproducible.

[perezd]

Also, in the container locally vscode user is user 1000 (according to id vscode):

uid=1000(vscode) gid=1000(vscode) groups=1000(vscode),999(golang),998(nvm)

The built container w/ this github action responds with this:

uid=1001(vscode) gid=121(vscode) groups=121(vscode),999(golang),998(nvm)

Not sure why it's different.

[perezd]

OK the problem was fixed by setting: skipContainerUserIdUpdate to true. That was just a very unclear option at first.