Fixed user and sudo under docker

[alanwilter]

This fixed several issues I created with my previous RP re docker.py.

Now it runs under $USER, grant permissions and allow sudo.

[sebhrusen]

@alanwilter, to be clear, this fixes issues introduced with #464, correct?

Could you please detail a bit more the kind of issues that were introduced by this? For us to understand the changes, for other users that may face the same problems… thanks.

[sebhrusen]

nitpick: thanks for not reformatting the entire file when you apply changes. For example, for strings I tend to use single quotes for keys/constants and double quotes for display strings: for my usage, it improves readibility. But more importantly, this PR/diff would focus only on relevant changes.
Same with new lines and so on. So, please revert all formatting changes, as I'd prefer not to see this becoming a new habit, thank you.

[alanwilter]

Sorry about that, my setup is with black, pyupgrade, pre-commit, isort etc. I will disable for this project.

[alanwilter]

@alanwilter, to be clear, this fixes issues introduced with #464, correct?

Could you please detail a bit more the kind of issues that were introduced by this? For us to understand the changes, for other users that may face the same problems… thanks.

Yes, I found out that when running docker and docker line RUN $PY {script} {framework} -s only was called, some frameworks need to install ubuntu packages etc. and this was failing.

Now all runs as the local user issuing the docker cmd and will save all for that user, and this user is enabled to run sudo inside the docker, without password.

The other issue addressed was that, again, when docker running RUN $PY {script} {framework} -s only, for some frameworks, directive ENV DEBIAN_FRONTEND noninteractive was not working to avoid tzdata to enter in the interactive mode. So, I found better to install it at the first opportunity. You can rearrange it as you wish.

I found this issue when debugging autoxgboost, which installs

  SUDO apt-get install -y r-base r-base-dev
  SUDO apt-get install -y libgdal-dev libproj-dev
  SUDO apt-get install -y libssl-dev libcurl4-openssl-dev
  SUDO apt-get install -y libcairo2-dev libudunits2-dev

and one of these pkgs has tzdata dependency.

[sebhrusen]

looks good to me, thanks for addressing this @alanwilter: mainly concerned about the behaviour of os.getXXid() on Windows.
Waiting for feedback from @PGijsbers about this, then I think we can merge.

[sebhrusen]

for Windows users, docker mode is often the only mode available to run most of the frameworks, so we need to ensure that this still works on Win.

@PGijsbers I now wonder how the original $(id -u $USER) calls worked on Win, are we requiring Bash on Windows? In this case, how does the Py commands os.getuid() and os.getgid() behave on Win?

[PGijsbers]

I can confirm this breaks on my windows system. This matches the Python documentation that availability is limited to Unix for those two commands.

[alanwilter]

I can't test that, but Windows (and Mac), don't mess up root with user, i.e., you run a docker as root that saves files, those files will belong to original windows/mac user and not to the root, like it happens in Linux.
Perhaps, just wrap these lines with a if linux ...

[PGijsbers]

Seems reasonable to me since it's a platform specific issue.

[PGijsbers]

@alanwilter
I picked up this PR since it went stale. I made sure Windows support was not broken.
Additionally, I added HDF5 libraries required to install tables. After the patches building and running in docker mode works for me on both MacOS and Windows. Could you confirm that after these patches the original program you fixed is still resolved with your setup?

[PGijsbers]

Thanks @alanwilter for fixing the initial problem!

[alanwilter]

You're welcome. I still need to find time to check the out #495 (comment)
But I have no idea when I will do that.

[PGijsbers]

Since there was no response for 3 weeks, I wasn't sure if you were still interested in trying so I went ahead and merged. If you do ever find the time to check, we would appreciate a quick confirmation :) But there's no rush, we'll operate under the assumption the problem is fixed (because, as far as I can tell, it is).

[PGijsbers]

This introduced an issue when building public images: the image is set up for the builder, but the user will start the container under a different uid, which leads to permission errors. I think we should maybe remove any user information from the docker container, and instead create/assign permissions on startup with something like:

set -e

if [ $UID = 0 ]; then
  echo "Docker started as root, not changing file permissions."
  exit 0
fi

user_id=$UID
echo "root" | su -c "adduser --disabled-password --gecos '' -uid $user_id amlb"
echo "root" | su -c "echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers"
echo "root" | su -c "chown -R amlb:amlb /home/amlb"
echo "root" | su -c "hown -R amlb:amlb /bench"
echo "root" | su -c "passwd -d amlb"
su "amlb"

[PGijsbers]

There's probably cleanier ways to set this up (though whatever UID is inserted is unlikely to be in de sudo file), but my experience lacks here.

[PGijsbers]

@alanwilter something like that should still solve your issue, right?

[alanwilter]

Unfortunately I'm not working on related projects anymore so I'd say do what is better for you guys. If I'll come back one day then I will check and test all that.

[PGijsbers]

Thanks for letting us know!