feat(cli): use non-root user for package build in docker

Author: mikonse

packages/debmagic/src/debmagic/cli/_build_driver/driver_docker.py

@@ -1,3 +1,4 @@
+import os
 import uuid
 from pathlib import Path
 from typing import Self, Sequence
@@ -16,12 +17,25 @@
 
 BUILD_DIR_IN_CONTAINER = Path("/debmagic")
 
+DOCKER_USER = "user"
+
 DOCKERFILE_TEMPLATE = f"""
 FROM {{base_image}}
 
-RUN apt-get update && apt-get -y install dpkg-dev python3
+ARG USERNAME={DOCKER_USER}
+ARG USER_UID=1000
+ARG USER_GID=$USER_UID
+
+RUN apt-get update && apt-get install -y sudo dpkg-dev python3
+
+RUN groupadd --gid $USER_GID $USERNAME \
+    && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME \
+    && echo $USERNAME ALL=\\(root\\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME \
+    && chmod 0440 /etc/sudoers.d/$USERNAME
 
 RUN mkdir -p {BUILD_DIR_IN_CONTAINER}
+RUN chown $USERNAME:$USERNAME {BUILD_DIR_IN_CONTAINER}
+USER $USERNAME
 ENTRYPOINT ["sleep", "infinity"]
 """
 
@@ -61,10 +75,18 @@ def create(cls, config: BuildConfig, driver_config: DockerDriverConfig) -> Self:
         dockerfile_path.write_text(formatted_dockerfile)
 
         docker_image_name = f"debmagic-{config.build_identifier}"
+
+        additional_args = []
+        if not os.getuid() == 0:
+            # to reduce potential permission problems with missing user remappings on some systems
+            # we simply create the build user inside the docker container with the same uid / gid as our host user
+            additional_args.extend(["--build-arg", f"USER_UID={os.getuid()}", "--build-arg", f"USER_GID={os.getgid()}"])
+
         ret = run_cmd(
             [
                 "docker",
                 "build",
+                *additional_args,
                 "--tag",
                 docker_image_name,
                 "-f",
@@ -109,15 +131,16 @@ def get_build_metadata(self) -> DriverSpecificBuildMetadata:
         return meta.model_dump()
 
     def run_command(self, cmd: Sequence[str | Path], cwd: Path | None = None, requires_root: bool = False):
-        del requires_root  # we assume to always be root in the container
+        conditional_args: list[str | Path] = []
 
         if cwd:
             cwd = self._translate_path_in_container(cwd)
-            cwd_args: list[str | Path] = ["--workdir", cwd]
-        else:
-            cwd_args = []
+            conditional_args.extend(["--workdir", cwd])
+
+        if requires_root:
+            conditional_args.extend(["--user", "root"])
 
-        ret = run_cmd(["docker", "exec", *cwd_args, self._container_name, *cmd], dry_run=self._dry_run)
+        ret = run_cmd(["docker", "exec", *conditional_args, self._container_name, *cmd], dry_run=self._dry_run)
         if ret.returncode != 0:
             raise BuildError("Error building package")