fix(docker): passwordless sudo for the non-root vp user by fengmk2 · Pull Request #2088 · voidzero-dev/vite-plus · GitHub

The toolchain image runs as the non-root vp user but shipped no sudo, so
playwright install --with-deps (Vitest browser mode) and any apt-get during
build or CI failed. When not already root, Playwright installs system libraries
via sudo if present and otherwise falls back to su root, which has no
password in the image, producing su: Authentication failure (the error in the
issue).

Change

Add sudo plus a NOPASSWD sudoers entry for vp. The image keeps its non-root
default (bind-mounted files stay uid 1000, Chromium keeps its sandbox) while
build, CI, and dev steps can reach root on demand. This matches the devcontainer
base images (non-root user + passwordless sudo) rather than flipping the whole
image to root. Docs get the model plus a Vitest browser-mode CI recipe.

Validation

Built a container from the changed layer and confirmed in one run: default user
is non-root vp (uid 1000); which sudo succeeds (so Playwright takes the sudo
branch); sudo -n true and the literal sudo -- sh -c 'apt-get ...' escalation
both work passwordlessly; and the no-sudo negative control reproduces the issue
error verbatim (su: Authentication failure).

Closes #2087

✅ Deploy Preview for viteplus-preview canceled.

Name	Link
🔨 Latest commit	5f293a1
🔍 Latest deploy log	https://app.netlify.com/projects/viteplus-preview/deploys/6a4f08576f3d1d00086b843c

fix(docker): passwordless sudo for the non-root vp user #2088 👈 (View in Graphite)
main

How to use the Graphite Merge Queue

Add the label auto-merge to this PR to add it to the merge queue.

You must have a Graphite account in order to use the merge queue. Sign up using this link.

An organization admin has enabled the Graphite Merge Queue in this repository.

Please do not merge from GitHub as this will restart CI on PRs being processed by the merge queue.

This stack of pull requests is managed by Graphite. Learn more about stacking.

✅ Staging deployment successful!

Preview: https://viteplus-staging.void.app/
Commit: 5f293a1

Registry bridge build (7f34427)

This commit build is published to the registry bridge, which serves these as ordinary npm versions (every other package proxies to npmjs):

Package	Version
vite-plus	0.0.0-commit.7f344277062f835a64e16f1eb10badc49c736bc4
@voidzero-dev/vite-plus-core	0.0.0-commit.7f344277062f835a64e16f1eb10badc49c736bc4

Install the Vite+ CLI built from this commit, then migrate a project:

# macOS / Linux
curl -fsSL https://vite.plus | VP_PR_VERSION=2088 bash

# Windows (PowerShell)
$env:VP_PR_VERSION="2088"; irm https://vite.plus/ps1 | iex

After installing, upgrade the current project's vite-plus to this test build with:

vp migrate

Or point your package manager at the bridge registry https://registry-bridge.viteplus.dev/:

Package manager	Registry config
npm / pnpm / Bun	.npmrc: registry=https://registry-bridge.viteplus.dev/
Yarn (v2+)	.yarnrc.yml: npmRegistryServer: "https://registry-bridge.viteplus.dev/"

Then pin the build (vite aliases to vite-plus-core; pnpm can use a catalog, npm an overrides entry):

{
  "devDependencies": {
    "vite-plus": "0.0.0-commit.7f344277062f835a64e16f1eb10badc49c736bc4",
    "vite": "npm:@voidzero-dev/vite-plus-core@0.0.0-commit.7f344277062f835a64e16f1eb10badc49c736bc4"
  }
}

🐳 Docker preview image

Built from this PR's registry bridge build:

Image	Compressed size
ghcr.io/voidzero-dev/vite-plus:pr-2088	241MB

# remove any stale local copy from a previous run, then pull fresh
docker rmi ghcr.io/voidzero-dev/vite-plus:pr-2088 2>/dev/null; docker pull ghcr.io/voidzero-dev/vite-plus:pr-2088

Quick check:

docker run --rm ghcr.io/voidzero-dev/vite-plus:pr-2088 vp --version

See docs/guide/docker.md for usage.

@codex review

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: c8583b944b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@codex review

Codex Review: Didn't find any major issues. Breezy!

Reviewed commit: a269384d4e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Merge activity

Jul 9, 12:57 AM UTC: fengmk2 added this pull request to the Graphite merge queue.
Jul 9, 1:10 AM UTC: The Graphite merge queue couldn't merge this PR because it was not satisfying all requirements (Failed CI: 'done', 'CLI snapshot test (x86_64-unknown-linux-gnu)', 'CLI snapshot test (aarch64-apple-darwin)', 'CLI snapshot test (Windows)').
Jul 9, 2:32 AM UTC: fengmk2 added this pull request to the Graphite merge queue.
Jul 9, 2:41 AM UTC: Merged by the Graphite merge queue.

The toolchain image runs as the non-root `vp` user but shipped no `sudo`, so `playwright install --with-deps` (Vitest browser mode) and any `apt-get` during build or CI failed. When not already root, Playwright installs system libraries via `sudo` if present and otherwise falls back to `su root`, which has no password in the image, producing `su: Authentication failure` (the error in the issue). ## Change Add `sudo` plus a NOPASSWD sudoers entry for `vp`. The image keeps its non-root default (bind-mounted files stay uid 1000, Chromium keeps its sandbox) while build, CI, and dev steps can reach root on demand. This matches the devcontainer base images (non-root user + passwordless sudo) rather than flipping the whole image to root. Docs get the model plus a Vitest browser-mode CI recipe. ## Validation Built a container from the changed layer and confirmed in one run: default user is non-root `vp` (uid 1000); `which sudo` succeeds (so Playwright takes the sudo branch); `sudo -n true` and the literal `sudo -- sh -c 'apt-get ...'` escalation both work passwordlessly; and the no-sudo negative control reproduces the issue error verbatim (`su: Authentication failure`). Closes #2087

) Release vite-plus v0.2.5: Cleaner environments and more reliable workflows. This release adds cleanup and package version commands, supports TypeScript 7 declaration generation, reduces the standalone binary size, and hardens task tracking, CLI output, package-manager routing, Docker workflows, and project scaffolding. ### Highlights - Add `vp env clean` to remove unused managed Node.js runtimes and package-manager caches ([#2003](#2003)), by @liangmiQwQ - Add `vp pm version`, forwarding native version commands to npm, pnpm, Yarn, and Bun ([#2127](#2127)), by @jong-kyung - Add TypeScript 7 support to declaration generation and generated library projects with tsdown `0.22.7` ([#2104](#2104), [#2168](#2168)), by @wan9chi - Improve automatic task input tracking for Bun on macOS, Linux containers with constrained `/dev/shm`, and Windows process images, reduce Windows backing-file allocation, and clarify task wait failures ([vite-task#515](voidzero-dev/vite-task#515), [vite-task#518](voidzero-dev/vite-task#518), [vite-task#523](voidzero-dev/vite-task#523), [vite-task#524](voidzero-dev/vite-task#524), [vite-task#542](voidzero-dev/vite-task#542), [#2126](#2126), [#2167](#2167)), by @wan9chi - Prevent CLI diagnostics from truncating or panicking when inherited standard output or error is nonblocking ([#2172](#2172), [#2173](#2173)), by @wan9chi ### Fixes & Enhancements - Reduce standalone `vp` binary sizes by about 5% on Linux and macOS and 19% on Windows ([#2043](#2043)), by @fengmk2 - Keep the Docker image non-root by default while allowing passwordless `sudo` for Playwright browser dependencies and system packages ([#2088](#2088)), by @fengmk2 - Ignore `.env` and `.env.*` in generated projects while keeping `.env.example` trackable ([#2095](#2095)), by @forehalo - Create `vp-use.cmd` after the Windows environment bin directory is ready and document its Command Prompt-only usage ([#2128](#2128)), by @liangmiQwQ - Render user-facing process statuses and paths without Rust debug wrappers ([#2130](#2130)), by @liangmiQwQ - Make `vp dedupe` fall back to `yarn install` with a warning on Yarn Classic ([#2139](#2139)), by @jong-kyung - Ensure package-manager child processes, including Bun, can always find the managed Node.js runtime ([#2158](#2158)), by @BlankParticle ### Docs - Update the release-manager post-release guidance ([#2096](#2096)), by @wan9chi - Add Windows to the Namespace sponsor credit ([#2108](#2108)), by @fengmk2 - Document installer and runtime environment variables, registry settings, TLS options, and precedence rules ([#2114](#2114)), by @yukinoshi - Mark shell examples in `CONTRIBUTING.md` as Bash code blocks ([#2159](#2159)), by @BlankParticle ### Chore - Assign prepared release PRs to the workflow actor ([#2094](#2094)), by @wan9chi - Complete the PTY snapshot migration and harden the runner, fixtures, release-version redaction, registry teardown, timeouts, and Linux parallelism ([#2071](#2071), [#2080](#2080), [#2084](#2084), [#2099](#2099), [#2102](#2102), [#2103](#2103), [#2107](#2107), [#2109](#2109), [#2115](#2115), [#2117](#2117), [#2118](#2118), [#2119](#2119), [#2120](#2120), [#2121](#2121), [#2131](#2131), [#2132](#2132), [#2134](#2134), [#2137](#2137), [#2138](#2138), [#2141](#2141), [#2143](#2143), [#2145](#2145), [#2182](#2182)), by @fengmk2 and @wan9chi - Expose Vite+ managed binaries consistently inside snapshot fixtures ([#2110](#2110)), by @liangmiQwQ - Exclude PTY snapshot configuration from Vitest discovery and remove the legacy snapshot infrastructure ([#2135](#2135), [#2146](#2146)), by @jong-kyung - Modernize Windows runners, registry bridge publishing, native size reporting, merge-base comparisons, and package-manager installation CI ([#2083](#2083), [#2100](#2100), [#2105](#2105), [#2106](#2106), [#2112](#2112), [#2133](#2133)), by @fengmk2 - Verify that created monorepo libraries emit declarations in CI ([#2171](#2171)), by @wan9chi ### Bundled Versions | Tool | Version | Source | | --------------- | ------- | ----------------------------------------------------------------------- | | vite | `8.1.4` | [`a477454`](vitejs/vite@a477454) | | rolldown | `1.1.5` | [`f09947a`](rolldown/rolldown@f09947a) | | tsdown | `0.22.7` | [npm](https://npmx.dev/package/tsdown/v/0.22.7) | | vitest | `4.1.10` | [npm](https://npmx.dev/package/vitest/v/4.1.10) | | oxlint | `1.73.0` | [npm](https://npmx.dev/package/oxlint/v/1.73.0) | | oxlint-tsgolint | `0.24.0` | [npm](https://npmx.dev/package/oxlint-tsgolint/v/0.24.0) | | oxfmt | `0.58.0` | [npm](https://npmx.dev/package/oxfmt/v/0.58.0) | ### Upgrade ```bash vp upgrade ``` ### New Contributors Welcome @yukinoshi and @BlankParticle. **Full Changelog**: v0.2.4...v0.2.5 --- Merging this PR will trigger the release workflow. --------- Co-authored-by: voidzero-guard[bot] <278573678+voidzero-guard[bot]@users.noreply.github.com> Co-authored-by: wan9chi <dk4rest@gmail.com>

fengmk2 added the preview-build Publish this PR's commits to the registry bridge as preview builds label Jul 7, 2026

fengmk2 mentioned this pull request Jul 7, 2026

Docker image to restrictive for vitest browser mode #2087

Closed

3 tasks

chatgpt-codex-connector Bot reviewed Jul 7, 2026

View reviewed changes

Comment thread docs/guide/docker.md Outdated

fengmk2 force-pushed the docker-nonroot-sudo branch from a269384 to 597714e Compare July 8, 2026 15:04

fengmk2 marked this pull request as ready for review July 8, 2026 15:04

fengmk2 self-assigned this Jul 8, 2026

fengmk2 requested review from Brooooooklyn and wan9chi July 8, 2026 15:15

fengmk2 force-pushed the docker-nonroot-sudo branch from f8f9ca2 to 6274ee2 Compare July 8, 2026 16:23

fengmk2 requested a review from cpojer July 9, 2026 00:56

cpojer approved these changes Jul 9, 2026

View reviewed changes

graphite-app Bot force-pushed the docker-nonroot-sudo branch from 6274ee2 to 6f512e6 Compare July 9, 2026 00:58

fengmk2 force-pushed the docker-nonroot-sudo branch from 6f512e6 to bb662c9 Compare July 9, 2026 02:06

graphite-app Bot force-pushed the docker-nonroot-sudo branch from 1c82d95 to 5f293a1 Compare July 9, 2026 02:32

graphite-app Bot merged commit 5f293a1 into main Jul 9, 2026
54 checks passed

graphite-app Bot deleted the docker-nonroot-sudo branch July 9, 2026 02:41

wan9chi mentioned this pull request Jul 15, 2026

release: v0.2.5: Cleaner environments and more reliable workflows #2180

Merged

BrewTestBot mentioned this pull request Jul 17, 2026

vite-plus 0.2.5 Homebrew/homebrew-core#293663

Merged

2 tasks

fix(docker): passwordless sudo for the non-root vp user by fengmk2 · Pull Request #2088 · voidzero-dev/vite-plus · GitHub

Uh oh!

fix(docker): passwordless sudo for the non-root vp user - #2088

fix(docker): passwordless sudo for the non-root vp user#2088
graphite-app[bot] merged 1 commit into
mainfrom
docker-nonroot-sudo

fengmk2 commented Jul 7, 2026 •
edited
Loading

Uh oh!

Uh oh!

netlify Bot commented Jul 7, 2026 •
edited
Loading

Uh oh!

Uh oh!

fengmk2 commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026 •
edited
Loading

Uh oh!

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

github-actions Bot commented Jul 7, 2026

Uh oh!

fengmk2 commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

Uh oh!

fengmk2 commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 7, 2026

Uh oh!

graphite-app Bot commented Jul 9, 2026 •
edited
Loading

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix(docker): passwordless sudo for the non-root vp user by fengmk2 · Pull Request #2088 · voidzero-dev/vite-plus · GitHub

Uh oh!

fix(docker): passwordless sudo for the non-root vp user - #2088

fix(docker): passwordless sudo for the non-root vp user#2088graphite-app[bot] merged 1 commit intomainvoidzero-dev/vite-plus:mainfrom docker-nonroot-sudovoidzero-dev/vite-plus:docker-nonroot-sudoCopy head branch name to clipboard

Conversation

fengmk2 commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change

Validation

Uh oh!

netlify Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Deploy Preview for viteplus-preview canceled.

Uh oh!

fengmk2 commented Jul 7, 2026

How to use the Graphite Merge Queue

Uh oh!

github-actions Bot commented Jul 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot commented Jul 7, 2026

Registry bridge build (7f34427)

Uh oh!

github-actions Bot commented Jul 7, 2026

🐳 Docker preview image

Uh oh!

fengmk2 commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

fengmk2 commented Jul 7, 2026

Uh oh!

chatgpt-codex-connector Bot commented Jul 7, 2026

Uh oh!

graphite-app Bot commented Jul 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Merge activity

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

fix(docker): passwordless sudo for the non-root vp user#2088
graphite-app[bot] merged 1 commit into
mainfrom
docker-nonroot-sudo

fengmk2 commented Jul 7, 2026 •
edited
Loading

netlify Bot commented Jul 7, 2026 •
edited
Loading

github-actions Bot commented Jul 7, 2026 •
edited
Loading

graphite-app Bot commented Jul 9, 2026 •
edited
Loading