Coder.com•3mo ago

Permission in Vscode - Docker template

Hello, I can run sudo mkdir test to create dir, but not without sudo, did I do something wrong?

main.tf

29 Replies

Codercord•3mo ago

<#1276045862417600534>

Category

Help needed

Product

code-server

Platform

Linux

Logs

Please post any relevant logs/error messages.

ÙwÚOP•3mo ago

FROM ubuntu

RUN apt-get update \
    && apt-get install -y \
    curl \
    git \
    golang \
    sudo \
    vim \
    wget \
    texlive-full \
    && rm -rf /var/lib/apt/lists/*

ARG USER=coder
RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
    && echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
    && chmod 0440 /etc/sudoers.d/${USER}
USER ${USER}
WORKDIR /home/${USER}

FROM ubuntu

RUN apt-get update \
    && apt-get install -y \
    curl \
    git \
    golang \
    sudo \
    vim \
    wget \
    texlive-full \
    && rm -rf /var/lib/apt/lists/*

ARG USER=coder
RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
    && echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
    && chmod 0440 /etc/sudoers.d/${USER}
USER ${USER}
WORKDIR /home/${USER}

Phorcys•3mo ago

hello it seems that you are not creating the home directory for the user

ÙwÚOP•3mo ago

This issue is kindda weird, but I believe because I mount a dir that non-root owned caused this issue Not really coder fault, I'll check it when I'm back home

Phorcys•3mo ago

let me know hey @ÙwÚ -- any luck?

ÙwÚOP•3mo ago

Sorry still out of town, I'll give you a ping when I'm back if you dont mind:)

Phorcys•3mo ago

alright, no worries, just wanted to make sure!

ÙwÚOP•2mo ago

hello just come back ok so turn out my old template, which I mount ~/repo (I own this dir, not root), was editable before, now it's not, so I may need some help find out how do I fix that @Phorcys what should I provide here? I think the content is pretty much similar to what I posted above

Phorcys•2mo ago

@ÙwÚ some of us are at Open Source Summit EU atm so the answers will likely be delayed a bit i'll come back to you next week if no one has answered your questions

ÙwÚOP•2mo ago

oh nah all good, i dont mind the wait, I can just mount one of dir root owned for now

Phorcys•2mo ago

could you send your template over? this is within Coder right

ÙwÚOP•2mo ago

ye happened in coder you meant the main.tf right ?

ÙwÚOP•2mo ago

main.tf

ÙwÚOP•2mo ago

note: /media/ser3_decoyer/TOSHIBA/ is a root owned /home/ser3_decoyer/repo/ is owned by ser3_decoyer

Phorcys•2mo ago

yes! could you run the following commands and send their output? - id - stat /home/Decoyer

ÙwÚOP•2mo ago

please dont worry about Decoyer/wibu, just the name different but they should have the same template config

coder@leetcode:/home/wibu/leetcode/leetcode$ id
uid=1001(coder) gid=1001(coder) groups=1001(coder),27(sudo)
coder@leetcode:/home/wibu/leetcode/leetcode$ ls /home
coder  ubuntu  wibu
coder@leetcode:/home/wibu/leetcode/leetcode$ stat /home/wibu
  File: /home/wibu
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: 8,1     Inode: 57813071    Links: 5
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2024-09-18 17:39:33.516648920 +0000
Modify: 2024-09-18 17:38:44.015072021 +0000
Change: 2024-09-18 17:38:44.015072021 +0000
 Birth: 2024-09-15 19:33:54.910531390 +0000
coder@leetcode:/home/wibu/leetcode/leetcode$

coder@leetcode:/home/wibu/leetcode/leetcode$ id
uid=1001(coder) gid=1001(coder) groups=1001(coder),27(sudo)
coder@leetcode:/home/wibu/leetcode/leetcode$ ls /home
coder  ubuntu  wibu
coder@leetcode:/home/wibu/leetcode/leetcode$ stat /home/wibu
  File: /home/wibu
  Size: 4096            Blocks: 8          IO Block: 4096   directory
Device: 8,1     Inode: 57813071    Links: 5
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2024-09-18 17:39:33.516648920 +0000
Modify: 2024-09-18 17:38:44.015072021 +0000
Change: 2024-09-18 17:38:44.015072021 +0000
 Birth: 2024-09-15 19:33:54.910531390 +0000
coder@leetcode:/home/wibu/leetcode/leetcode$

Phorcys•2mo ago

does mkdir /home/wibu/something work? also, could you send the output of cat /etc/passwd | grep coder? also, are wibu/Decoyer users that exist within the Coder workspace?

ÙwÚOP•2mo ago

let decide on 1 user for now, im logging as wibu user Decoyer was my previous workspace, I stopped it tho anyways, here's mkdir return

coder@leetcode:~$ mkdir /home/wibu/test
mkdir: cannot create directory '/home/wibu/test': Permission denied
coder@leetcode:~$ cat /etc/passwd | grep coder
coder:x:1001:1001::/home/coder:/bin/bash
coder@leetcode:~$ cat /etc/passwd | grep wibu
coder@leetcode:~$

coder@leetcode:~$ mkdir /home/wibu/test
mkdir: cannot create directory '/home/wibu/test': Permission denied
coder@leetcode:~$ cat /etc/passwd | grep coder
coder:x:1001:1001::/home/coder:/bin/bash
coder@leetcode:~$ cat /etc/passwd | grep wibu
coder@leetcode:~$

hmm ok from the output ig wibu user doesnt exist ?

Phorcys•2mo ago

alright so @ÙwÚ, the issue is related to permissions in your case, the directory being mounted to /home/wibu is owned by root, and rwx r-x r-x permissions (owner, group, other) your coder user is not the owner or the group, so it falls in the "other" category of the permissions on that folder, and since it only has read and execute permissions, it can't create any files or folders

ÙwÚOP•2mo ago

ok im guessing it related to my dockerfile ?

Phorcys•2mo ago

the issue in your case is that the coder user should not exist in the first place and be replaced by the username at image build time

ÙwÚOP•2mo ago

im pulling it up

Phorcys•2mo ago

basically, when mounting the folder to /home/<user> Docker sees that the directory doesn't exist and creates it with some default permissions the way to fix this is to create the directory with the appropriate permissions before Docker mounts it, so the fix is to create the user

ÙwÚOP•2mo ago

I do have some basics with permissions, but not much with docker

FROM ubuntu:latest
RUN mkdir /packages
RUN apt-get update && apt-get install -y apt-transport-https
COPY packages.txt "/packages/packages.txt"



RUN apt-get -y update \
    && apt-get install -y \
    build-essential \
    gcc-multilib \
    gdb \
    curl \
    git \
    golang \
    sudo \
    vim \
    wget \
    && rm -rf /var/lib/apt/lists/*

#RUN xargs -a /packages/packages.txt apt-get install -y
ARG USER=coder
ARG TZ=America/Vancouver
RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
    && echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
    && chmod 0440 /etc/sudoers.d/${USER}
USER ${USER}
WORKDIR /home/${USER}

#$(cat /packages/packages.txt | tr '\n' ' ') \

FROM ubuntu:latest
RUN mkdir /packages
RUN apt-get update && apt-get install -y apt-transport-https
COPY packages.txt "/packages/packages.txt"



RUN apt-get -y update \
    && apt-get install -y \
    build-essential \
    gcc-multilib \
    gdb \
    curl \
    git \
    golang \
    sudo \
    vim \
    wget \
    && rm -rf /var/lib/apt/lists/*

#RUN xargs -a /packages/packages.txt apt-get install -y
ARG USER=coder
ARG TZ=America/Vancouver
RUN useradd --groups sudo --no-create-home --shell /bin/bash ${USER} \
    && echo "${USER} ALL=(ALL) NOPASSWD:ALL" >/etc/sudoers.d/${USER} \
    && chmod 0440 /etc/sudoers.d/${USER}
USER ${USER}
WORKDIR /home/${USER}

#$(cat /packages/packages.txt | tr '\n' ' ') \

so the problem was because I have USER=coder ? this is the docker file created with coder cli, so im not sure how it got there

Phorcys•2mo ago

well no the problem is rather that the argument you are passing to the Docker image in your template to replace coder by the user's name is not taking effect either live with coder or try to find the root cause basically

ÙwÚOP•2mo ago

@Phorcys ok I think I found the root cause, I remember now, I wanted to use a pre-built image when create container

#image = "codercom/code-server:latest"
image = "colab-env-cpp"

#image = "codercom/code-server:latest"
image = "colab-env-cpp"

then I used docker build to create image colab-env-cpp b4 hand docker build ./build -t colab-env-cpp however this seems like not a proper way to use a pre-built image how would you guys do it ?

Phorcys•2mo ago

so the usual way would be to use CI/CD to build the image and then push to a registry (for example, you can use GHCR) though if you plan on using a prebuilt image, then you will want to mount the persistent volume to /home/coder instead of /home/<user> hey @ÙwÚ, can we close this thread?

ÙwÚOP•2mo ago

Ye sure, still figuring out the prebuilt, but i think should be fine

Codercord•2mo ago

@Phorcys closed the thread.

Gaming

Programming

Permission in Vscode - Docker template