Skip to content

Replace umask usage with files permission change when a non-root image used

Tomasz Maczukin requested to merge update-files-permission-if-no-root-used into master

This MR is based on top of !2534 (merged)

Please merge first the dependent MR, then change the target branch here to master and continue with review

What does this MR do?

Removes the usage of umask 0000 within docker (and docker+machine) executor. Change driven by a feature flag.

When a FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR flag is set, then Runner will:

  1. Drop usage of umask 0000 when starting the predefined image.
  2. Inspect the image used for creating the job container and check if a custom user is defined.
  3. If custom user is defined - execute id -u and id -r on the job container to gather the UID and GID of the container main process.
  4. Run chwon -RP UID:GID on the project working directory, using UID and GID gathered in previous step.

With this the job will get files without changed permissions (read: with the permissions set to 644 for files and 755 for directories, which is the default Git behavior) and with the ownership of the files changed to the user of the job container.

Why was this MR needed?

This is the next step of #1736 (closed). Please check the issue description for context.

What's the best way to test this MR?

See #1736 (closed)

Tested in a playground project with and without feature flag:

image

What are the relevant issue numbers?

Closes #1736 (closed)

Merge request reports