(asset-staging): local bundling fails inside a docker container with non-existent user #15415

akuntsch · 2021-07-05T07:01:59Z

We run our CDK scripts inside a Node.js docker container inside a Jenkins pipeline. Jenkins runs docker containers with the host user (docker run -u ...) which does not necessarily exist inside the docker container. Bundling fails inside the Jenkins pipeline because CDK tries to read the user from /etc/passwd, even though the user is not used when using local asset bundling.

Reproduction Steps

Run CDK code with local asset bundling inside a docker container with non-existent user (e.g. docker run -u 1234:1234).

What did you expect to happen?

Local asset bundling works inside a docker container with non-existent user.

What actually happened?

Asset bundling fails with the following error:

SystemError [ERR_SYSTEM_ERROR]: A system error occurred: uv_os_get_passwd returned ENOENT (no such file or directory)

Environment

CDK CLI Version : 1.108.0 (build b23f781)
Framework Version: 1.108.0
Node.js Version: v14.17.0
OS : Docker on Linux (node:14 docker image)
Language (Version): TypeScript (4.3.4)

Other

Should be fixed by #15313.

This is 🐛 Bug Report

The text was updated successfully, but these errors were encountered:

Currently, when not explicitly passing a user in BundlingOptions, `os.userInfo()` is called as a default fallback. Even though the user is only used and needed when using docker bundling, it is still called when using local bundling. This can be problematic e.g. when running cdk scripts inside a docker container where the user does not exist inside the container (see #15415). Fixes #15415. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

github-actions · 2021-08-11T09:08:48Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

Currently, when not explicitly passing a user in BundlingOptions, `os.userInfo()` is called as a default fallback. Even though the user is only used and needed when using docker bundling, it is still called when using local bundling. This can be problematic e.g. when running cdk scripts inside a docker container where the user does not exist inside the container (see aws#15415). Fixes aws#15415. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

serverhorror · 2021-09-02T12:02:52Z

@peterwoodworth, @akuntsch I think I just ran into this same issue, could there be a regression/edge case?

This happens inside of OpenShift where the user doesn't exist. Only a UID. It doesn't happen when it runs with a user that is actually visible via e.g. getent passwd ...

Runing a plain cdk version fails miserably:

cdk version
SystemError [ERR_SYSTEM_ERROR]: A system error occurred: uv_os_get_passwd returned ENOENT (no such file or directory)
    at Object.userInfo (os.js:347:11)
    at cdkHomeDir (/opt/node/lib/node_modules/aws-cdk/lib/util/directories.ts:7:21)
    at Object.cdkCacheDir (/opt/node/lib/node_modules/aws-cdk/lib/util/directories.ts:11:20)
    at new AccountAccessKeyCache (/opt/node/lib/node_modules/aws-cdk/lib/api/aws-auth/account-cache.ts:25:44)
    at Object.<anonymous> (/opt/node/lib/node_modules/aws-cdk/lib/api/aws-auth/sdk.ts:51:42)
    at Module._compile (internal/modules/cjs/loader.js:1072:14)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1101:10)
    at Module.load (internal/modules/cjs/loader.js:937:32)
    at Function.Module._load (internal/modules/cjs/loader.js:778:12)
    at Module.require (internal/modules/cjs/loader.js:961:19)

Same for cdk synth

cdk synth --context vpc-id=vpc-0123456789 --context irods-ami-id=ami-0123456789 iRods
os.js:347

SystemError [ERR_SYSTEM_ERROR]: A system error occurred: uv_os_get_passwd returned ENOENT (no such file or directory)
    at Object.userInfo (os.js:347:11)
    at cdkHomeDir (/opt/node/lib/node_modules/aws-cdk/lib/util/directories.ts:7:21)
    at Object.cdkCacheDir (/opt/node/lib/node_modules/aws-cdk/lib/util/directories.ts:11:20)
    at new (/opt/node/lib/node_modules/aws-cdk/lib/api/aws-auth/account-cache.ts:25:44)
    at Object.<anonymous> (/opt/node/lib/node_modules/aws-cdk/lib/api/aws-auth/sdk.ts:51:42)
    at Module._compile (internal/modules/cjs/loader.js:1072:14)
    at Object.Module._extensions..js (internal/modules/cjs/loader.js:1101:10)
    at Module.load (internal/modules/cjs/loader.js:937:32)
    at Function.Module._load (internal/modules/cjs/loader.js:778:12)

Environment

CDK CLI Version : 1.121.0 (build 026cb8f)
Framework Version: 1.108.0
Node.js Version: v14.17.0
OS : RedHat OpenShift 3.11 (node v14.17.5, based on docker.io/amazon/aws-cli:2.2.33 )
Language (Version): Python 3.7.10

peterwoodworth · 2021-09-02T20:03:05Z

Thanks for the ping, I've reopened the issue for investigation

Currently, when not explicitly passing a user in BundlingOptions, `os.userInfo()` is called as a default fallback. Even though the user is only used and needed when using docker bundling, it is still called when using local bundling. This can be problematic e.g. when running cdk scripts inside a docker container where the user does not exist inside the container (see aws#15415). Fixes aws#15415. ---- *By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license*

a-h · 2022-01-12T15:12:36Z

I'm encountering this with CDK 1.138.2, deploying inside a custom container based on the node:16 Docker container.

Github actions uses the root user which doesn't exist in the Node image (only the node user does), so this is the scenario where a user home directory doesn't exist.

I worked around it by not using my custom Docker image, and used the built-in Github Actions Ubuntu image with the setup-node Github Action applied until this is sorted.

adambro · 2022-03-22T08:18:03Z

Try setting CDK_HOME=/tmp as I did in #19401 that should do the trick for asset building. For running a CDK Pipelines like in #19401 issue it might not be enough, due to bug in safeUsername() function.

adambro · 2022-05-11T14:54:31Z

I've proposed trivial fix in #20188 PR already. PR validation failed, because there's no test. For such simple function that is a helper called in private method from private method it's hard to write a proper test without crazy os module mock.

TheRealAmazonKendra · 2023-01-26T23:22:05Z

Looks like this was fixed in #20188. If that is not correct and there are still issues around this, please open a new issue.

github-actions · 2023-01-26T23:22:30Z

⚠️COMMENT VISIBILITY WARNING⚠️

Comments on closed issues are hard for our team to see.
If you need more assistance, please either tag a team member or open a new issue that references this one.
If you wish to keep having a conversation with other community members under this issue feel free to do so.

akuntsch added bug This issue is a bug. needs-triage This issue or PR still needs to be triaged. labels Jul 5, 2021

peterwoodworth added the package/tools Related to AWS CDK Tools or CLI label Jul 6, 2021

peterwoodworth assigned rix0rrr Jul 6, 2021

rix0rrr added effort/medium Medium work item – several days of effort p2 and removed needs-triage This issue or PR still needs to be triaged. labels Jul 7, 2021

rix0rrr removed their assignment Jul 7, 2021

akuntsch mentioned this issue Jul 30, 2021

fix(core): asset bundling fails for non-existent user #15313

Merged

mergify bot closed this as completed in #15313 Aug 11, 2021

peterwoodworth reopened this Sep 2, 2021

mb-dev mentioned this issue Sep 25, 2021

CDK CLI errors when run as a non-existent user #7937

Closed

dennispost mentioned this issue Feb 18, 2022

context-provider: Context loading fails when /etc/passwd is not available #18824

Closed

TheRealAmazonKendra closed this as completed Jan 26, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

(asset-staging): local bundling fails inside a docker container with non-existent user #15415

(asset-staging): local bundling fails inside a docker container with non-existent user #15415

akuntsch commented Jul 5, 2021

github-actions bot commented Aug 11, 2021

serverhorror commented Sep 2, 2021

peterwoodworth commented Sep 2, 2021

a-h commented Jan 12, 2022 •

edited

Loading

adambro commented Mar 22, 2022

adambro commented May 11, 2022

TheRealAmazonKendra commented Jan 26, 2023

github-actions bot commented Jan 26, 2023

(asset-staging): local bundling fails inside a docker container with non-existent user #15415

(asset-staging): local bundling fails inside a docker container with non-existent user #15415

Comments

akuntsch commented Jul 5, 2021

Reproduction Steps

What did you expect to happen?

What actually happened?

Environment

Other

github-actions bot commented Aug 11, 2021

⚠️COMMENT VISIBILITY WARNING⚠️

serverhorror commented Sep 2, 2021

peterwoodworth commented Sep 2, 2021

a-h commented Jan 12, 2022 • edited Loading

adambro commented Mar 22, 2022

adambro commented May 11, 2022

TheRealAmazonKendra commented Jan 26, 2023

github-actions bot commented Jan 26, 2023

⚠️COMMENT VISIBILITY WARNING⚠️

a-h commented Jan 12, 2022 •

edited

Loading