Run Docker container as current user

[Kurt-von-Laven]

Fixes #1975.

Previously, mega-linter-runner ran the MegaLinter Docker image as root. Users whose files became owned by root as a consequence of this behavior will need to chown them to be owned by the appropriate user. This change only affects POSIX platforms, because process.getuid and process.getgid are only available there.

Proposed Changes

1. Instruct the MegaLinter Docker container to inherit the UID and GID of the mega-linter-runner process.

Readiness Checklist

Author/Contributor

• Add entry to the CHANGELOG listing the change and linking to the corresponding issue (if appropriate)
• If documentation is needed for this change, has that been included in this pull request

Reviewing Maintainer

• Label as breaking if this is a large fundamental change
• Label as either automation, bug, documentation, enhancement, infrastructure, or performance

[nvuillam]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ BASH	bash-exec	6		0	0.01s
✅ BASH	shellcheck	6		0	0.15s
✅ BASH	shfmt	6	0	0	0.3s
✅ COPYPASTE	jscpd	yes		no	2.48s
✅ DOCKERFILE	hadolint	116		0	14.84s
✅ JSON	eslint-plugin-jsonc	21	0	0	2.09s
✅ JSON	jsonlint	19		0	0.18s
✅ JSON	v8r	21		0	13.23s
⚠️ MARKDOWN	markdownlint	312	0	230	6.56s
✅ MARKDOWN	markdown-link-check	312		0	5.39s
✅ MARKDOWN	markdown-table-formatter	312	0	0	16.16s
✅ OPENAPI	spectral	1		0	1.43s
⚠️ PYTHON	bandit	185		54	2.02s
✅ PYTHON	black	185	0	0	4.75s
✅ PYTHON	flake8	185		0	2.92s
✅ PYTHON	isort	185	0	0	0.66s
✅ PYTHON	mypy	185		0	6.59s
✅ PYTHON	pylint	185		0	10.69s
⚠️ PYTHON	pyright	185		251	15.72s
✅ PYTHON	ruff	185	0	0	0.36s
✅ REPOSITORY	checkov	yes		no	29.94s
✅ REPOSITORY	git_diff	yes		no	0.3s
✅ REPOSITORY	secretlint	yes		no	11.95s
✅ REPOSITORY	trivy	yes		no	27.5s
✅ SPELL	cspell	753		0	19.3s
✅ SPELL	misspell	572	0	0	0.69s
✅ XML	xmllint	3	0	0	0.32s
✅ YAML	prettier	81	0	0	2.79s
✅ YAML	v8r	23		0	60.19s
✅ YAML	yamllint	82		0	1.09s

See detailed report in MegaLinter reports

MegaLinter is graciously provided by

[nvuillam]

I'm no docker expert but you seem to know what you are doing :)

[nvuillam]

.... but CI seems to disagree ^^

[Kurt-von-Laven]

What sources of persistence between jobs are there (e.g., caching, artifacts, the Docker images themselves)? My instinct is that some files may still be owned by root that should never have been because of the bug this change seeks to fix.

[codecov-commenter]

Codecov Report

Merging #1985 (f5ea7e2) into main (fb2fe2e) will increase coverage by 0.02%.
The diff coverage is n/a.

📣 This organization is not using Codecov’s GitHub App Integration. We recommend you install it so Codecov can continue to function properly for your repositories. Learn more

@@            Coverage Diff             @@
##             main    #1985      +/-   ##
==========================================
+ Coverage   83.00%   83.03%   +0.02%     
==========================================
  Files         171      171              
  Lines        4514     4514              
==========================================
+ Hits         3747     3748       +1     
+ Misses        767      766       -1     

Impacted Files	Coverage Δ
megalinter/reporters/AzureCommentReporter.py	42.10% <ø> (ø)
megalinter/reporters/UpdatedSourcesReporter.py	89.74% <0.00%> (+2.56%)	⬆️

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[nvuillam]

🦙 MegaLinter status: ⚠️ WARNING

Descriptor	Linter	Files	Fixed	Errors	Elapsed time
✅ BASH	bash-exec	6		0	0.01s
✅ BASH	shellcheck	6		0	0.14s
✅ BASH	shfmt	6	0	0	0.04s
✅ COPYPASTE	jscpd	yes		no	2.65s
✅ DOCKERFILE	hadolint	116		0	16.7s
✅ JSON	eslint-plugin-jsonc	21	0	0	1.8s
✅ JSON	jsonlint	19		0	0.18s
✅ JSON	npm-package-json-lint	yes		no	0.64s
✅ JSON	v8r	21		0	13.94s
⚠️ MARKDOWN	markdownlint	312	2	230	6.22s
✅ MARKDOWN	markdown-link-check	312		0	5.23s
✅ MARKDOWN	markdown-table-formatter	312	2	0	16.68s
✅ OPENAPI	spectral	1		0	1.48s
⚠️ PYTHON	bandit	185		54	2.18s
✅ PYTHON	black	185	0	0	4.06s
✅ PYTHON	flake8	185		0	1.96s
✅ PYTHON	isort	185	0	0	0.45s
✅ PYTHON	mypy	185		0	7.36s
✅ PYTHON	pylint	185		0	11.39s
⚠️ PYTHON	pyright	185		251	16.34s
✅ PYTHON	ruff	185	0	0	0.15s
✅ REPOSITORY	checkov	yes		no	32.43s
⚠️ REPOSITORY	devskim	yes		61	1.26s
✅ REPOSITORY	dustilock	yes		no	2.08s
✅ REPOSITORY	git_diff	yes		no	0.07s
✅ REPOSITORY	secretlint	yes		no	7.64s
✅ REPOSITORY	syft	yes		no	0.87s
✅ REPOSITORY	trivy	yes		no	23.6s
✅ SPELL	cspell	753		0	19.04s
✅ SPELL	misspell	572	2	0	0.52s
✅ XML	xmllint	3	0	0	0.03s
✅ YAML	prettier	81	0	0	2.72s
✅ YAML	v8r	23		0	65.29s
✅ YAML	yamllint	82		0	1.33s

See detailed report in MegaLinter reports

You could have same capabilities but better runtime performances if you request a new MegaLinter flavor.

• Click here to request the new flavor

MegaLinter is graciously provided by

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this pull request should stay open, please remove the O: stale 🤖 label or comment on the pull request.

[github-actions]

This pull request has been automatically marked as stale because it has not had recent activity.
It will be closed in 14 days if no further activity occurs.
Thank you for your contributions.

If you think this pull request should stay open, please remove the O: stale 🤖 label or comment on the pull request.

[Kurt-von-Laven]

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed updating files.

[Kurt-von-Laven]

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.

[echoix]

/build ref=docker-user

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed updating files.

[Kurt-von-Laven]

/build ref=docker-user

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed updating files.

[Kurt-von-Laven]

/build ref=docker-user

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed updating files.

[stevenh]

Would love to see this merged as there seems to be no way to run megalinter without it trashing the current file permissions.

[Kurt-von-Laven]

I was never able to figure out why the tests where failing, but would love to get this wrapped up if anybody understands what is going on. We use rootless-docker both for improved security and to avoid modifying file ownership.

[reixd]

Any news on this?

[nvuillam]

If @Kurt-von-Laven (or any motivated contributor like you ?) finds some available time, it could move again :)

On my side, my docker level is not advanced enough to handle the task :/

[sanmai-NL]

It's less relevant nowadays: https://docs.docker.com/engine/security/userns-remap/