FIPS build cannot run shell executor by default
As described in #418292 (closed), running the FIPS image with a shell executor fails out of the box for two reasons:
- In the prep job it's throwing
mkdir: cannot create directory '/builds': Permission denied - In the build jobs it's throwing
Password: su: Authentication failure.
This happens because due to gitlab-runner@51d5167c:
- The image runs as UID 1001 by default (a non-existent user). This user doesn't have the ability to
mkdir /builds. -
--user=gitlab-runneris passed to the runner. This causes the shell executor to runsu: https://gitlab.com/gitlab-org/gitlab-runner/-/blob/f29584e83f2b39572d44cc15efbced87a928d1b4/shells/bash.go#L361-375. However, normallysucan only be run byroot, so the we get thePassword: su: Authentication failureerror.
@ratchade Was UID 1001 supposed to be gitlab-runner? On the FIPS image, it appears UID 998 belongs to gitlab-runner.
Perhaps we should consider modifying the shell executor to run su only if the current user doesn't match the target user.