mirror of
https://github.com/nektos/act.git
synced 2026-04-26 01:15:51 +03:00
[GH-ISSUE #398] Write files as user, not root #281
Labels
No labels
area/action
area/cli
area/docs
area/image
area/runner
area/workflow
backlog
confirmed/not-planned
kind/bug
kind/discussion
kind/external
kind/feature-request
kind/question
meta/duplicate
meta/invalid
meta/need-more-info
meta/resolved
meta/wontfix
meta/workaround
needs-work
pull-request
review/not-planned
size/M
size/XL
size/XXL
stale
stale-exempt
No milestone
No project
No assignees
1 participant
Notifications
Due date
No due date set.
Dependencies
No dependencies set.
Reference
starred/act#281
Loading…
Add table
Add a link
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @arifer612 on GitHub (Oct 21, 2020).
Original GitHub issue: https://github.com/nektos/act/issues/398
Hi there, first of all, I'd really love to thank you for this wonderful project. It's been a wonderful aid for my personal projects.
I would like to suggest a feature to add to this project. When new files are created (e.g. documentations / MAKE files), the owner of the file is
rootand not user, even with the--bindflag turned on. I feel it would make more sense for the files to be owned by user and notroot, especially since the container is supposed to be 'bound' to the working directory.I have tried to change the ownership by explicitly including
chownuser, but being a containerised environment, user does not exist and returns the error messagechown: invalid user:user@torbjornvatn commented on GitHub (Nov 12, 2020):
@arifer612 Have you check how this works "live" on Github?
Are the user or root set as owner of files there?
@github-actions[bot] commented on GitHub (Jan 12, 2021):
Issue is stale and will be closed in 7 days unless there is new activity
@catthehacker commented on GitHub (Jan 12, 2021):
actcurrently doesn't support non-root users.@github-actions[bot] commented on GitHub (Feb 19, 2021):
Issue is stale and will be closed in 14 days unless there is new activity
@Totktonada commented on GitHub (Apr 19, 2021):
The act tool stitch two worlds: GitHub Actions runners in clouds that are far away from us and the make experience that is under our fingers.
My opinion is that here we should pay more attention to the second aspect rather than how GitHub Actions works per se.
I use --bind as workaround for #193 and here I would like to share another recipe from the packpack tool. It uses so called userwrapper.sh script as an entrypoint to create a user inside the container with uid and gid equal to ones of a user that that runs the tool. It works like a charm (seriously, I can just forget about all those
su -c 'chown -R <...> .'after each build).The only problem we (tarantool team) see with this approach is when the tool is run under a system user (it was a user for GitLab Runner) and a system user with the same ID exists in a particular image. It is quite rare situation, though, and there are possible ways to mitigate it. See details here. (To be honest, we worked it around by changing uid on our machines and didn't implement some general solution yet.)
@aytey commented on GitHub (Oct 30, 2021):
Does this mean we should be running
actundersudo?@catthehacker commented on GitHub (Oct 30, 2021):
no, Docker image should use root account
@aytey commented on GitHub (Oct 30, 2021):
So if not using
bind, and you want to create files inside of the repo you're checking out, what's the recommended workflow? My experience here is that whoever is the default user that is running the actions cannot write to cwd.@joeyparrish commented on GitHub (Dec 20, 2021):
I think this can be fixed by running
chmod -R runner.runner /path/to/workingdirinside the container act, right after copying files to it. I'll try to put together a PR.@joeyparrish commented on GitHub (Dec 20, 2021):
My fix is working for me locally in my own workflows, and the change was pretty small. It recursively changes ownership of the copied files to
runner. This change in behavior will also makeactmore consistent with GitHub Actions. There, checkouts are done as therunneruser by default, leaving all files owned by that user.@catthehacker commented on GitHub (Dec 20, 2021):
No because not every image has
runneruser and not every image hasrunneruser with same ID of host user runningact@joeyparrish commented on GitHub (Dec 20, 2021):
That would be correct for
--bind. My change will fix the situation where you aren't using--bind. In that situation with the latestact, some files copied from the working directory are owned byroot, which can break workflows that work perfectly well in GitHub's environment.@joeyparrish commented on GitHub (Dec 20, 2021):
In fact, I'd like to attempt a fix for
--bind, as well. I think the user ID ofrunnerin the container can be modified to match the local user, just before the rest of the container setup runs. But I'll save that for a follow-up PR once the easier fix (without--bind) is complete.@catthehacker commented on GitHub (Dec 20, 2021):
I haven't pushed PR yet but I added option to run as custom user some time ago
github.com/catthehacker/act-fork@a4dd723dd1@joeyparrish commented on GitHub (Dec 20, 2021):
@catthehacker, I cherry-picked the change you mentioned, and tried it out. Mine is in slight conflict in that
"runner.runner"in my change should be replaced withrc.Config.ContainerUserwhen that exists.Your also has a small bug as far as I can tell. The directory
/home/runner/work/also needs to be owned by the container user. Otherwise some of the actions in my workflow fail withEACCES.Would it be helpful if I integrated your work into mine and tested everything with
--bind?@catthehacker commented on GitHub (Dec 20, 2021):
Why? We don't use that path at all and actions should not hardcode paths
@catthehacker commented on GitHub (Dec 20, 2021):
I haven't tested it but feel free to use it however you like, as long as the commit has preserved authorship.
@joeyparrish commented on GitHub (Dec 20, 2021):
I don't know. I'm not that familiar with how actions work internally. I can show you the logs, though. The docs workflow in https://github.com/Valheim-Modding/Jotunn is what I'm playing with at the moment. It's the
nuget/setup-nuget@v1action that fails, with:I thought this was due to ownership, but I might have been wrong. It seems to only happen with
--container-user 1000 --bind. (Where 1000 is my local UID.)I'll investigate a bit more this time before I declare that I know what the problem is. :-)
@catthehacker commented on GitHub (Dec 20, 2021):
It would be good to know what Docker image are you using

For me it works ok (not counting missing
mono)@joeyparrish commented on GitHub (Dec 20, 2021):
My
~/.actrcis:And my instinct was right: it was ownership after all. But I had a bug in my additional
chowncommand for/home/runner. I accidentally made it conditional oncopyWorkspace, like the firstchownI added. With that bug fixed, I now have something working with--bindand--container-user, as well as with neither.Here are the changes I'm testing:
github.com/joeyparrish/act@14ef5ab452github.com/catthehacker/act-fork@a4dd723dd1--container-userto"runner", since a blank string doesn't work so well in constructedchowncommands"runner.runner"torc.Config.ContainerUserrc.Config.ContainerUseron/home/runnerI've pushed all that to my fork, and you can decide how you'd like to proceed. If we can agree on those changes, though, I think all my use-cases would be taken care of. Everything is in PR #934 now, including your commit (with merge conflicts fixed, commit message and authorship unaltered).
Thanks for your time!
@stovmascript commented on GitHub (May 25, 2022):
How is this looking? I would really welcome the
--container-useroption. Or at least aligning the user across the existing images.Act will reach my workflow jobs on the medium image, but not on the full image, as it fails setting up the repo because of owner issues. I need to use the full image because I'm using the GitHub CLI (
gh) in my workflow, which is not available on the medium image.@LuisAlejandro commented on GitHub (Sep 1, 2022):
So, functionality was added in #1202, but how do we use it? I don't seem to find instructions anywhere
@ChristopherHX commented on GitHub (Sep 2, 2022):
You need a non root user docker image and act will extract the uid and gid to create files in the container. Therefore the only thing needed is a
-P <runs-on-label>=<custom image>flag pointing to a custom image with a non root user.If you use non root user container e.g an image created by a dockerfile with
USERnow files are created with the docker image user instead of rootIf you use
--bind, an unsafe flag:@LuisAlejandro commented on GitHub (Sep 2, 2022):
Thank you very much for your explanation!
@airtonix commented on GitHub (Nov 20, 2023):
Is this ticket related to the fact that whenever i run act, all the files get chown'd to root?
after each run, i have to run
.actrcis