Check the logged user instead of $USER - #3330
Conversation
Sorry, something went wrong.
Given that `sudo usermod --login "$DOCKER_USER" coder` and `sudo groupmod -n "$DOCKER_USER" coder` modify the container's disk it'll persist across restarts, but environment variables will be reset to whatever state they had at the end of `Dockerfile`. In this case, `$USER` is set to `coder`, so this branch will always be true. By checking with the output of `whoami`, which gets it's information from `/etc/passwd`, we make sure to get the real logged user and not the one defined by $USER. We also move `USER="$DOCKER_USER"` out of the branch, since we always want this to happen at entry-point. If we don't do this assignment, $USER will contain `coder` upon restart.
code-asher
left a comment
There was a problem hiding this comment.
Thank you for fixing this!! Your PR description was fantastic too.
Sorry, something went wrong.
|
Thanks for making your first contribution! 🙂 |
Sorry, something went wrong.
Codecov Report
@@ Coverage Diff @@
## main #3330 +/- ##
=======================================
Coverage 58.95% 58.95%
=======================================
Files 35 35
Lines 1703 1703
Branches 374 374
=======================================
Hits 1004 1004
Misses 561 561
Partials 138 138 Continue to review full report at Codecov.
|
Sorry, something went wrong.
|
You can ignore the trivy-scan failure. We're aware of that and working on a fix. As for the audit vulnerabilities, we're also aware of a postcss CVE that needs to be fixed. Everything else looks good! |
Sorry, something went wrong.
Check `$DOCKER_USER` was defined before copying it to `$USER`.
code-asher
left a comment
There was a problem hiding this comment.
🎉 🎉 🎉
Sorry, something went wrong.
Given that sudo usermod --login "$DOCKER_USER" coder and sudo groupmod -n "$DOCKER_USER" coder modify the container's disk it'll persist across restarts, but environment variables will be reset to whatever state they had at the end of Dockerfile. In this case, $USER is set to coder, so this branch will always be true.
By checking with the output of whoami, which gets it's information from /etc/passwd, we make sure to get the real logged user and not the one defined by $USER.
We also move USER="$DOCKER_USER" out of the branch, since we always want this to happen at entry-point. If we don't do this assignment, $USER will contain coder upon restart.
Fixes #2767.