Merge pull request #1895 from spotify/scaffolder/user-id

Scaffolder: Default to running the Container as the same user as the node process

plugins/scaffolder-backend/src/scaffolder/stages/templater/helpers.test.ts

@@ -126,6 +126,26 @@ describe('helpers', () => {
       );
     });
 
+    it('should pass through the user and group id from the host machine and set the home dir', async () => {
+      await runDockerContainer({
+        imageName,
+        args,
+        templateDir,
+        resultDir,
+        dockerClient: mockDocker,
+      });
+
+      expect(mockDocker.run).toHaveBeenCalledWith(
+        imageName,
+        args,
+        expect.any(Stream),
+        expect.objectContaining({
+          User: `${process.getuid()}:${process.getgid()}`,
+          Env: ['HOME=/tmp'],
+        }),
+      );
+    });
+
     it('should pass through the log stream to the docker client', async () => {
       const logStream = new PassThrough();
       await runDockerContainer({

plugins/scaffolder-backend/src/scaffolder/stages/templater/helpers.ts

@@ -71,6 +71,7 @@ export const runDockerContainer = async ({
       return undefined;
     });
   });
+
   const [{ Error: error, StatusCode: statusCode }] = await dockerClient.run(
     imageName,
     args,
@@ -85,6 +86,14 @@ export const runDockerContainer = async ({
           `${await fs.promises.realpath(templateDir)}:/template`,
         ],
       },
+      // Files that are created inside the Docker container will be owned by
+      // root on the host system on non Mac systems, because of reasons. Mainly the fact that
+      // volume sharing is done using NFS on Mac and actual mounts in Linux world.
+      // So we set the user in the container as the same user and group id as the host.
+      User: `${process.getuid()}:${process.getgid()}`,
+      // Set the home directory inside the container as something that applications can
+      // write to, otherwise they will just flop and fail trying to write to /
+      Env: ['HOME=/tmp'],
       ...createOptions,
     },
   );