Lets add simple checkbox «dont delete user when project stopped»!

[belonesox]

Right now, cocalc-hub creates ephemeral users when corresponding projects are running and deletes then after project is stopped.

…
    try {
      this.stateChanging = { state: "stopping" };
      await this.saveStateToDatabase(this.stateChanging);
      await deleteUser(this.project_id);
      await this.wait({
        until: async () => !(await isProjectRunning(this.HOME)),
        maxTime: MAX_STOP_TIME_MS,
      });
    } finally {
…

May be, it is good for security, but we losing lot of usecases:

• working as this user with its userdata when project is stopped (for example, working with project data connecting with sshfs, or other mounts)
• working as this user even is cocalc stopped or restarted (for example, running long tasks, user services)
• adding this user to some server groups (ad-hoc security tuning…)
• ... lot more.

Lets add simple checkbox «dont delete user when project stopped»!

Actually, this is connected to #6277 but looks little simpler (one checkbox on project settigs UI, little patching on src/packages/server/projects/control/multi-user.ts…

This is usable for non-docker installation (I exproring some way to integrate cocalc with other services,like nextcloud, etc), and
of course, also may be global setting 'disable user tuning' to disable this for docker version of cocalc.

If you approve the idea, I will try to implement it.

[williamstein]

I do approve this idea.

Note to anybody else who sees this, it is about how cocalc runs as part of cocalc-docker (not cocalc.com or cocalc-cloud). This wouldn't impact anything except cocalc-docker, and would be relatively easy to change. Of course, you can also run cocalc directly in the same mode as cocalc-docker which is why the remark ("This is usable for non-docker installation (I exproring some way to integrate cocalc with other services,like nextcloud, etc), and of course, also may be global setting 'disable user tuning' to disable this for docker version of cocalc.").

I would be fine with a simpler solution -- just never delete the user. I.e., delete the one line of code that deletes the user. That would be really easy for you to implement.

[belonesox]

According this discussion, deleting of user disabled in
packages/server/projects/control/multi-user.ts

      this.stateChanging = { state: "stopping" };
      await this.saveStateToDatabase(this.stateChanging);
      await stopProjectProcesses(this.project_id);
      //   await deleteUser(this.project_id);

and all looks OK for 9 month...
... but we have also deleteUser at packages/server/projects/control/util.ts

  try {
    await make_target_path();
  } catch (_err) {
    // The above probably failed due to the uid/gid not existing.
    // In that case, we create the user, then try again.
    await createUser(target_project_id);
    await make_target_path();
    // Assuming the above did work, it's very likely the original
    // failing was due to the user not existing, so now we delete
    // it again.
    await deleteUser(target_project_id);
  }

that also fires sometimes (deletes user that something wrong in path) that complicates debugging and looks inconsistent.
May be comment this line also?

[williamstein]

and all looks OK for 9 month...

Not exactly. Not deleting users resulted in situations where projects wouldn't start, because there was code in cocalc-docker that assumed the user had been deleted, and that code broke if this wasn't true, in some cases. I fixed this 4 days ago, since I kept running into stuck projects that wouldn't restart without killing all relevant processes of that user, and when I tracked it down, this was why:
ttps://github.com/sagemathinc/cocalc/commit/dde763435716c47b197edfa3f0f9a01a6b1942ca

That said, I'm totally in support of this ticket and adding an admin setting to not delete user when project stops, at least on cocalc docker. You just have to edit a file in packages/util/db-schema/settings to add such a setting, and then use it via await serverSettings() in packages/settings.