stack image container needs --allow-different-user

[alexanderkjeldaas]

Since stack image container might run stack build, but will fail when --allow-different-user is required.

This option is almost always required when working in a docker environment.

(IMO the correct option is to drop this option from stack as it's not stacks job to (wrongly) guess the policy of the local setup).

[TheWizardTower]

I'm 90% sure I follow what you're saying. But can you give me steps to reproduce this, just so I'm certain?

Thanks!

Adam

[mgsloan]

Hmm, worth considering! I haven't encountered the need for that flag much. Pinging @borsboom

Note that you can put allow-different-user: true in your global configuration, and now you don't need to pass the flag all over the place. This may make your build scripts not work for others, though, so perhaps best to just put it in your project stack.yaml.

[TheWizardTower]

So, I've tinkered around with this problem from a few angles.

First off, the source code already does this, at least from one angle:

from src/Stack/Config.hs, line 376:

     configAllowDifferentUser <-
        case getFirst configMonoidAllowDifferentUser of
            Just True -> return True
            _ -> getInContainer

Now I'm not 1,000% this is passed on to the invocation of stack inside the container, but I couldn't find any evidence it wasn't. That being said, I'm very much a novice in this codebase, so don't take my judgement as gospel.

The other data point I have is I was able to successfully run stack image container inside the yesod container, after blowing away my ~/.stack dir.

To be clear, the process:

1. rm -rf ~/.stack
2. stack unpack yesod
3. cd yesod-1.4.5
4. stack init
5. stack image container --verbose

The above process works for me, using Version 1.4.0 x86_64.

@alexanderkjeldaas -- If you can provide the exact steps to reproduce the failure you're describing, it'd make this much easier.

@snoyberg -- ping.

[alexanderkjeldaas]

I still don't see any reason to have the flag --allow-other-user. It's absolutely none of stack's business to have a policy on ownership of files, at least not as an error.

Stack will basically refuse to work in any circumstance unless this option is given in every invocation when the source or build directory is shared with a container. In this case, the directory must be owned by 1000:1000 (default first uid on ubuntu).

(I think the flag should be renamed to --please).

I'll see if I can provide a step-by-step setup, but it's quite obvious that there is no way to work with stack both outside and inside a docker image. Basically if you have your CI docker image and you want to do something like:

$ docker run -v$PWD:/code my-ci-image '/bin/bash -c "cd /code; stack build"'

It can never work unless stack build fails outside the docker image.

I don't think it's any of stack's business to be in this fail-always setup by default.

[CThuleHansen]

I just encountered this, and I completely agree with @alexanderkjeldaas

[adept]

I also just encountered this, and I second both @alexanderkjeldaas and @CThuleHansen : "stack build" or "stack script" will either work inside your CI container or outside, but not in both places at the same time, which is super annoying :(

[qrilka]

I didn't try it out myself but I suppose that the option --docker-set-user should align users on host and in Docker

[adept]

@qrilka in my use-case docker container is not created by "stack build --docker" (or any other stack invocation) -- i just want to use "haskell:8" docker image and run "stack script" inside it as non-root user, so --docker-set-user will not help.
It also looks like stack script ignores config.yaml - once i confirm this, i will be opening separate issue about it

[qrilka]

@adept but I think that's the problem - if you don't create a user everything is run/created by root, maybe you could resolve it with --docker-run-args by passing --user like for example:

$ docker run --rm -it -v $PWD:/pwd --user 1000:1000 haskell:8 touch /pwd/created-in-docker
$ ls -l created-in-docker 
-rw-r--r-- 1 qrilka qrilka 0 июн  4 19:38 created-in-docker

But some steps could require user to be created in container.

[adept]

@qrilka Ah, i see... Indeed, my container is ran with --user.

For posterity, using haskell:8.8.3 image with stack 3.2.1 solved my particular issue: this version of stack uses config.yaml where i can put allow-different-user: yes and it works

[qrilka]

I guess you don't have a time machine and it's 2.3.1, right?

[adept]

:) Sure, that was 2.3.1