[Dockerfile Conversion] add USER directive

[vsoch]

Dockerfile USER directives should be removed and a warning emitted (I assume, or is this possible in Singularity?) from #44

[vsoch]

hey @bbarker is there any reason we can't switch to the user, given that command? Eg. take this recipe

From: continuumio/miniconda3
Bootstrap: docker

%post
    echo "Who am I?"
    whoami
    export SUDOVAR=DEFINED
    echo "SUDOVAR is ${SUDOVAR}"
    echo "1. Creating user koala"
    useradd -ms /bin/bash koala
    echo "2. Changing to user koala"
    su koala
    echo "SUDOVAR is ${SUDOVAR}"
    echo "3. Changing to root"
    su root
    whoami 
    echo "SUDOVAR is ${SUDOVAR}"

and running we see the environment is passed, and the user change seems to work. Note that, as with Docker, the user needs to be created.

Running post scriptlet
+ echo Who am I?
Who am I?
+ whoami
root
+ export SUDOVAR=DEFINED
+ echo SUDOVAR is DEFINED
SUDOVAR is DEFINED
+ echo 1. Creating user koala
1. Creating user koala
+ useradd -ms /bin/bash koala
+ echo 2. Changing to user koala
2. Changing to user koala
+ su koala
+ echo SUDOVAR is DEFINED
SUDOVAR is DEFINED
+ echo 3. Changing to root
3. Changing to root
+ su root
+ whoami
root
+ echo SUDOVAR is DEFINED
SUDOVAR is DEFINED
Finalizing Singularity container
Calculating final size for metadata...
Skipping checks
Building Singularity image...

[bbarker]

Hmm, good point, I think. Maybe a warning should still be given, since very often USER is who things will be run as in Docker. Which wouldn't work in singularity without root at runtime.

[vsoch]

This is for build time, and for Singularity during build it is always root. Could you give an example of the case you are worried about?

[vsoch]

Warning is added:

WARNING /tmp/requirements.txt doesn't exist, ensure exists for build
WARNING /code/ doesn't exist, ensure exists for build
WARNING "USER amy" -> "su amy"

[bbarker]

An example would be where USER is set before the entrypoint, analogous to doing % runscript as a different user, but other examples can be made related to file permissions.

[vsoch]

This isn't supported in Singularity (the user outside the container is the user inside the container) so I think for now we should add this base / vanilla change, and address specific issues as they come up for users.

[joseph-long]

Currently, USER is passed through the conversion (spython recipe Dockerfile) unmodified with no warning, which makes a broken recipe. As an interim measure, a warning stating that all build steps run as root would have been enough for me to modify my Dockerfile appropriately...

[vsoch]

I'll point out that I did changes for this fix, and nobody tested:

#46

I'll also point out that at runtime, any USER directive from the dockerfile wouldn't be honored, as Singularity user inside the container== user outside the container. However, given a change of user doing the build, this might have relevance. If you want to proceed, please test the PR (likely it will need to be updated too) and give your thoughts on:

• if /where to put the warning
• the current implementation

For future issues, please know that it is also responsibility of those making the request to test any changes in the PR, especially in the case that the work is done for them. Thanks!

[joseph-long]

I'm probably not the right person to do that, since I have yet to successfully run a single Singularity container :) I'll take a look, though

[vsoch]

haha, sounds good :) Do you need any help?

[vsoch]

This will be partially supported in #119 , specifically if a line in the install starts with USER it will be written as a USER <x> docker statement. For Singularity, since there is no equivalent USER directive, we would still need some custom statement to change user (not implemented yet). The old PR with the code there still remains, if anyone reading this ever desires this.

[vsoch]

This has been merged.