AppCDS containerized generation runs with UID 1000 which can clash with an existing user with UID 1000 on the host

[davidreis97]

Describe the bug

In my current setup, when creating an AppCDS archive using the property quarkus.package.create-appcds=true and executing mvn package -Dquarkus.container-image.build=true, the user that is running the mvn command has a UID 1000 and GID 1000.

To create the appcds archive, the following command is run:
podman run -v /devfolder/target:/tmp/quarkus:z --user 1000:1000 -w /tmp/quarkus/quarkus-app --rm registry.access.redhat.com/ubi8/openjdk-21-runtime:1.18 java -XX:ArchiveClassesAtExit=app-cds.jsa -Dquarkus.appcds.generate=true -jar quarkus-run.jar

Since the /target folder has 755 permission octal and the user with UID 1000 that exists on the host does not exist in the /etc/passwd of the container that podman spawns, the container is unable to write the archive to the folder. The creation fails with the following error:

[9.824s][error ][cds] Unable to create shared archive file app-cds.jsa: (Permission denied).

I was able to fix this by adding the argument argument --userns=keep-id to the podman run command. As you can see here this argument ensures that the current user in my host also exists in the /etc/passwd of the container. However, I didn't find any way to pass this command in the current AppCDS flow.

As I mentioned in #38020, albeit in a different context, I feel like the best solution here would be to allow the dev to add arguments or modify the command that gets called, since that fixes not just my issue but any other that may arise.

Expected behavior

No response

Actual behavior

No response

How to Reproduce?

No response

Output of uname -a or ver

Darwin <computer_name> 23.2.0 Darwin Kernel Version 23.2.0: Wed Nov 15 21:53:18 PST 2023; root:xnu-10002.61.3~2/RELEASE_ARM64_T6000 arm64 arm Darwin

Output of java -version

openjdk version "21.0.1" 2023-10-17 OpenJDK Runtime Environment (build 21.0.1+12-29) OpenJDK 64-Bit Server VM (build 21.0.1+12-29, mixed mode, sharing)

Quarkus version or git rev

Quarkus 3.7.1

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.8.6

Additional information

No response

[geoand]

As I mentioned in #38020, albeit in a different context, I feel like the best solution here would be to allow the dev to add arguments or modify the command that gets called, since that fixes not just my issue but any other that may arise.

I definitely understand the sentiment here, but I would like to avoid this if possible since adding arbitrary arguments to the AppCDS generation command could lead to unexpected results.

I was able to fix this by adding the argument argument --userns=keep-id to the podman run command.

I wonder if any of our folks who use podman can confirm this is the right thing to do. @zakkak maybe?

[zakkak]

I wonder if any of our folks who use podman can confirm this is the right thing to do. @zakkak maybe?

Yes, this sounds like the right thing to do, and we actually do it already for native builds when using a builder image.

[geoand]

Cool, thanks

[geoand]

@davidreis97 mind giving #38644 a try?

[davidreis97]

@geoand The fix works on my side. Thanks for the usual responsiveness!

[geoand]

Thank you for the spot on investigation of the problem!