Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support running as non-root user #18

Merged
merged 1 commit into from
Jan 2, 2023
Merged

Support running as non-root user #18

merged 1 commit into from
Jan 2, 2023

Conversation

bloodearnest
Copy link
Member

Previously, we relied on various paths inside the image that required
root privileges to read or write. Specifically:

  1. We need to write the env var supplied license to
    /usr/local/stata/stata.lic. This is handle via symlink
  2. We used the /root/entrypoint.sh - this has been move to
    /usr/local/bin/entrypoint.sh
  3. We shipped various core libraries in /root/ado/plus, which is one of
    the default per-user locations. Apart from the path permissions, the
    'plus' package namespace is often used by users in their own code[1].
    So instead, switch to /usr/local/ado, the default SITE location,
    which a) is outside /root/ and b) matches our intended usage, and is
    b/w compat with users using their own PLUS or PERSONAL paths in
    analysis code.
  4. We autoload ./libraries/*.ado, which is now done as the user running
    the command, so need to also work non-root. For now, to avoid further
    collisions with use of PLUS, we add them to the SITE dir. This did
    require making the SITE dir world writable, so that we can link into
    it.

Given the changes above, added test coverage for both the stata
libraries shipped with the docker image, as well as studies with
./libraries/.

Previously, we relied on various paths inside the image that required
root privileges to read or write. Specifically:

1. We need to write the env var supplied license to
   `/usr/local/stata/stata.lic`. This is handle via symlink
2. We used the /root/entrypoint.sh - this has been move to
   /usr/local/bin/entrypoint.sh
3. We shipped various core libraries in /root/ado/plus, which is one of
   the default per-user locations. Apart from the path permissions, the
   'plus' package namespace is often used by users in their own code[1].
   So instead, switch to /usr/local/ado, the default SITE location,
   which a) is outside /root/ and b) matches our intended usage, and is
   b/w compat with users using their own PLUS or PERSONAL paths in
   analysis code.
4. We autoload ./libraries/*.ado, which is now done as the user running
   the command, so need to also work non-root. For now, to avoid further
   collisions with use of PLUS, we add them to the SITE dir. This did
   require making the SITE dir world writable, so that we can link into
   it.

Given the changes above, added test coverage for both the stata
libraries shipped with the docker image, as well as studies with
./libraries/.

[1] https://github.com/opensafely/hh-classification-research/blob/734f2bf08959582a2ef7524c8355e1494f04d243/analysis/global.do
@bloodearnest bloodearnest merged commit 48263d3 into main Jan 2, 2023
@bloodearnest bloodearnest deleted the run-as-non-root branch January 2, 2023 13:25
@bloodearnest bloodearnest mentioned this pull request Jan 17, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants