Skip to content

Detect rootless mode #1484

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
themr0c wants to merge 11 commits into from
Closed

Detect rootless mode #1484

Changes from 1 commit
Commits
Show all changes
11 commits
Select commit Hold shift + click to select a range
7c16c3e
fix #1243 - the -u option is not necessary on podman
themr0c Jun 2, 2020
5c1cd81
the -u option is not necessary on a rootless environment
themr0c Jun 3, 2020
a8887d2
the -u option is not necessary on a rootless environment (rewrite by …
themr0c Jun 3, 2020
4416c3d
add AttributeError again
themr0c Jun 3, 2020
818a909
output before try
themr0c Jun 4, 2020
79528ec
Not just output, move this whole thing out.
themr0c Jun 4, 2020
b0fc24f
docker.py reworked, thanks @hroncok
themr0c Jun 15, 2020
da85e73
docker.py tests, thanks @hroncok
themr0c Jun 15, 2020
12a40fd
docker.py tests thanks @hroncok
themr0c Jun 15, 2020
dff7d60
docker.py tests thanks @hroncok
themr0c Jun 15, 2020
9d4fe3a
add pragma: win32 no cover
themr0c Jun 15, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Prev Previous commit
Next Next commit
Not just output, move this whole thing out.
  • Loading branch information
@themr0c
themr0c committed Jun 4, 2020
commit 79528ec13edabe842aa0340445affe5044756765
14 changes: 7 additions & 7 deletions pre_commit/languages/docker.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -82,14 +82,14 @@ def get_docker_user() -> Tuple[str, ...]: # pragma: win32 no cover
('docker', 'system', 'info'),
text=True,
)
Comment on lines +82 to +84

@Kurt-von-Laven Kurt-von-Laven Apr 17, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

It would be even faster and simplify both the logic below and the mock output used in testing to only query Docker/Podman for the field we care about. From the rootless-docker GitHub Action's README, docker info --format "{{ .ClientInfo.Context }}" outputs rootless in Docker when in rootless mode, and other strings (most commonly default, I believe) otherwise. I suspect, based on Podman's documentation, that podman info --format "{{ .host.security.rootless }}" outputs true when in rootless mode and false otherwise. Go templates are quite powerful, so we can say: docker info --format '{{ if .ClientInfo.Context }} {{ eq .ClientInfo.Context "rootless" }} {{ else }} {{ .host.security.rootless }} {{ end }}'. This command outputs true when running in rootless mode and false otherwise in both Docker and Podman, although I have only tested it on Docker. I don't have Podman installed, so hopefully someone who does can straighten me out if I'm mistaken. Disclosure: I am the author of the rootless-docker GitHub Action.

@alexvorndran alexvorndran Jun 3, 2022

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Here on my machine (Linux Mint 19.3, Docker version 20.10.16, build aa7e414) your suggestion returns default for rootless docker, as rootless seems to be part of the Security Options under Server.

@Kurt-von-Laven Kurt-von-Laven Jun 5, 2022 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for letting me know. Bummer that the behavior isn't consistent across our machines even on the exact same build of Docker. I am on Ubuntu 22.04, but I wonder whether the difference has more to do with how we installed rootless Docker? It's possible to detect rootless mode under SecurityOptions too (e.g., docker info --format '{{ range .SecurityOptions }}{{ if eq . "name=rootless" }}true{{ end }}{{ end }}'), FWIW.

@alexvorndran alexvorndran Jun 5, 2022

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

IIRC I followed the official instructions for Ubuntu. Maybe you chose to set the client context explicitly where I went for the DOCKER_HOST environment variable? Both options are listed in the instructions: https://docs.docker.com/engine/security/rootless/#client

@Kurt-von-Laven Kurt-von-Laven Jun 5, 2022

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes, you are correct. I suppose one could check the DOCKER_HOST environment variable before running docker info.

for line in output.splitlines():
# rootless docker has "rootless"
# rootless podman has "rootless: true"
if line.strip().startswith('rootless'):
if 'false' not in line:

@hroncok hroncok Jun 15, 2020

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note: Technically, the case where false is present is not tested. However in practice, we haven't found a case like this, this check is present as precaution.

@webknjaz webknjaz Jun 15, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This would be useful as a code comment

@themr0c themr0c Jun 15, 2020

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is that what is causing the coverage error?

Name                             Stmts   Miss Branch BrPart  Cover   Missing
----------------------------------------------------------------------------
pre_commit/languages/docker.py      72      2     10      2    95%   89->91, 91, 101->102, 102

@webknjaz webknjaz Jun 15, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is weird. If tests include example outputs containing rootless, they should also hit this condition check.

@webknjaz webknjaz Jul 3, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@asottile any ideas about this?

@asottile asottile Jul 3, 2020 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

there's no test for rootless: false so line 91 is never hit -- perhaps simpler would be if line.strip() == 'rootless: true': ...

@webknjaz webknjaz Jul 3, 2020

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That would probably not catch docker's behavior. Better to just improve the test matrix

return () # no -u for rootless
break
Comment thread
themr0c marked this conversation as resolved.
try:
for line in output.splitlines():
# rootless docker has "rootless"
# rootless podman has "rootless: true"
if line.strip().startswith('rootless'):
if 'false' not in line:
return () # no -u for rootless
break
return ('-u', f'{os.getuid()}:{os.getgid()}')
except AttributeError:
return ()
Expand Down