Parse the last line of stdout for UID/GID
What does this MR do?
A Docker container can run commands on entrypoint that output to stdout. For example, suppose you had an entrypoint script that does this:
echo "Hello world"
exec "@$"
If FF_DISABLE_UMASK_FOR_DOCKER_EXECUTOR is enabled, this results in an error:
image UID: parsing "id -u" output: strconv.Atoi: parsing "Hello world\n1000": invalid syntax (stderr: )
Fix this by reading the last line of stdout.
This came out of investigation of a failed dast job that was ultimately fixed with https://gitlab.com/gitlab-org/security-products/analyzers/browserker/-/merge_requests/1679.
How to validate locally
- I created this
entrypoint.sh:
#!/bin/bash
echo "Hello world"
exec "$@"
-
Run
chmod +x entrypoint.sh -
Create this
Dockerfile:
FROM registry.gitlab.com/security-products/dast:6
COPY entrypoint.sh /browserker
-
docker build . -t test:latest -
In my
runners.dockerconfig I set:
[runners.docker]
helper_image = "docker.io/library/gitlab-runner-helper:local"
pull_policy = "if-not-present"
- Rebuilt the helper and binary and configured a job to use
test:latest.
Edited by Stan Hu