Revert "Revert "Update to Elixir 1.18 (#132)" (#133)" #134
Conversation
|
Also, is this worth signalling to the Elixir core team? Maybe they could fix this by setting the permissions of this new directory to any user, or is it a security risk? |
Dockerfile
Outdated
| # clear temp files created by root to avoid permission issues | ||
| RUN rm -rf /tmp/* |
There was a problem hiding this comment.
This may work, but the typical way to separate between compilation stages and running stages of a docker container is using a multi-stage build, which would look like this:
# Stage 1: Build
FROM hexpm/elixir:1.18.1-erlang-27.2-debian-bookworm-20241223 as builder
# Get the source code
WORKDIR /opt/test-runner
COPY . .
# Compile the formatter
WORKDIR /opt/test-runner/exercism_test_helper
RUN mix local.rebar --force && \
mix local.hex --force && \
mix deps.get && \
MIX_ENV=test mix compile
# Build the escript
RUN MIX_ENV=prod mix escript.build
# Stage 2: Runner
FROM hexpm/elixir:1.18.1-erlang-27.2-debian-bookworm-20241223
# Install SSL ca certificates and dependencies
RUN apt-get update && \
apt-get install bash jo jq -y
# Create appuser
RUN useradd -ms /bin/bash appuser
# Set working directory
WORKDIR /opt/test-runner
# Copy the compiled application from the builder stage
COPY --from=builder /opt/test-runner .
USER appuser
# Entrypoint script
ENTRYPOINT ["/opt/test-runner/bin/run.sh"]There was a problem hiding this comment.
I actually tried that, copying from the analyzer dockerfile, but I didn't manage to make it work, I'll try harder
I'd say it's borderline. The idea of this |
Can we come up with a reasonable demo scenario where this problem would be shown? I was trying to come up with something but...
So I was unable to create a scenario where, with normal usage, Maybe this can be better recreated in Docker? Or maybe with two non-root users? Setting up a second non-root user on my own machine would be a pain in the ass. But I used to work like that, with two users. When I used one laptop for work and for private stuff. So it is a possible scenario. If that will cause issues for users, it's worth reproducing and reporting to the Elixir team... |
|
PS: I could merge this PR after work today, in ~9h, so that I have time to react if it goes wrong again. |
|
I could reproduce it with two normal users trying to compile normal projects, and I think it's worth opening an issue, this could happen for any project created by different users. |
Some time after pushing the 1.18 update, several students had the following issue
I believe that this is because when we build the project using
mix, the/tmp/mix_pubsubfolder is created. But since the build is created byroot,appuserwill later be unable to modify it.I modified the build to clear
/tmpbefore passing over toappuserand it worked locally for me.What this PR is missing is a good explanation of why this wasn't detected before and a new test to prevent similar issues.
When I used
bin/run-in-docker.sh slug /path/to/exercise ., it all worked fine. I could only reproduce the issue by using the docker container interactively withdocker run -it --entrypoint /bin/bash exercism/elixir-test-runnerand runningbin/run.sh slug /opt/test-runner/test/hello-world/ /tmp.Suggestions welcome.