Feature request: Introduce cache setting that doesn't preserve user/group permissions
Summary
If your GitLab CI configuration uses cache: to store paths across runs, jobs which use a container which has a non-root USER will fail if they attempt to modify cached content which was used by a different user ID.
(this report was previously misleading: we had the Code Quality template included and since it used the cache generated by the previous job that had the effect of changing the UID for files cached by the earlier jobs)
Steps to reproduce
.gitlab-ci.yml
cache:
key:
files:
- pyproject.toml
- poetry.lock
paths:
- .cache/pip
- .cache/poetry
build:
stage: build
image: some_container_with_a_non_root_user
before_script:
- pip install poetry
- poetry install
Actual behavior
On the first build, everything works. On the next, it will fail:
Restoring cache
Checking cache for 0-3d199f589330ea5dccd0e66f77a2f38a19827dbe-27-protected...
No URL provided, cache will not be downloaded from shared cache server. Instead a local version of cache will be extracted.
WARNING: .cache/poetry/usage-history-service-54JI6V8g-py3.9/bin/python: chmod .cache/poetry/usage-history-service-54JI6V8g-py3.9/bin/python: no such file or directory (suppressing repeats)
Successfully extracted cache
Executing "step_script" stage of the job script
Using docker image sha256:d62e81f1dc8d2c648b0b306a9bfb795f84219cc72d133301385d2d6549ba09bb …
$ pip install poetry
WARNING: The directory '/builds/…/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.
Defaulting to user installation because normal site-packages is not writeable
Requirement already satisfied: poetry in /usr/local/lib/python3.9/site-packages (1.3.2)…
…
$ poetry install
The virtual environment found in /builds/… seems to be broken.
Recreating virtualenv … in /builds/…
[Errno 13] Permission denied: '.gitignore'
Clearing the runner caches will resolve this, as will doing anything which invalidates the cache such as changing one of the key files listed.
Expected behavior
The cache should be restored owned by the USER specified in the container.
Environment description
Self-hosted GitLab Premium 15.9.2
config.toml contents
concurrent = 4
check_interval = 0
user = "gitlab-runner"
shutdown_timeout = 0
[session_server]
session_timeout = 1800
[[runners]]
name = "…"
url = "https://git.example.org"
id = 0
token = "…"
token_obtained_at = 0001-01-01T00:00:00Z
token_expires_at = 0001-01-01T00:00:00Z
tls-ca-file = "/etc/gitlab-runner/config/certs/ca.crt"
executor = "docker"
[runners.cache]
MaxUploadedArchiveSize = 0
[runners.docker]
tls_verify = false
image = "docker:latest"
dns = […]
privileged = true
disable_entrypoint_overwrite = false
oom_kill_disable = false
disable_cache = false
volumes = ["/cache", "/certs/client"]
shm_size = 0
Used GitLab Runner version
$ rpm -q gitlab-runner
gitlab-runner-15.9.1-1.x86_64
Edited by Chris Adams