Skip to content

Commit cd31c30

Browse files
justinmk3justinmk3
authored
Merge #3551 "Running as root without --no-sandbox"
2 parents 4e40536 + f53186e commit cd31c30

File tree

3 files changed

+71
-42
lines changed

3 files changed

+71
-42
lines changed

‎.github/workflows/node.js.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -11,7 +11,7 @@ on:
1111

1212
jobs:
1313
macos:
14-
name: macOS nodejs
14+
name: test macOS
1515
runs-on: macos-latest
1616
strategy:
1717
matrix:
@@ -53,7 +53,7 @@ jobs:
5353
flags: codewhisperer
5454

5555
windows:
56-
name: Windows nodejs
56+
name: test Windows
5757
runs-on: windows-2019
5858
strategy:
5959
matrix:
@@ -83,7 +83,7 @@ jobs:
8383
flags: windows-unittests
8484

8585
lint:
86-
name: Ubuntu nodejs Lint
86+
name: Lint
8787
runs-on: ubuntu-latest
8888
strategy:
8989
matrix:

‎buildspec/linuxIntegrationTests.yml‎

Lines changed: 46 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ phases:
1919
java: latest
2020

2121
commands:
22-
- bash buildspec/setup-github-token.sh
2322
- '>/dev/null add-apt-repository universe'
2423
- '>/dev/null apt-get -qq install -y apt-transport-https'
2524
- '>/dev/null apt-get -qq update'
@@ -33,22 +32,38 @@ phases:
3332
- 'python3.8 --version'
3433
# Dependencies for running vscode.
3534
- '>/dev/null apt-get -yqq install libatk1.0-0 libgtk-3-dev libxss1 xvfb libasound2 libasound2-plugins'
36-
- '>/dev/null pip3 install --upgrade aws-sam-cli'
37-
# Print info about sam (version, location, …).
38-
- 'pip3 show aws-sam-cli'
39-
- '>/dev/null pip3 install --upgrade awscli'
40-
- '>/dev/null pip3 install pylint'
41-
# Install latest version of Go (known to 'goenv')
42-
- '>/dev/null VERSION=$(goenv install --list | tail -n 1) && 2>/dev/null goenv install $VERSION'
43-
- '>/dev/null goenv global $VERSION && go env -w GOPROXY=direct'
44-
- go version
4535
# login to DockerHub so we don't get throttled
46-
- docker login --username $(echo $DOCKER_HUB_TOKEN | jq -r '.username') --password $(echo $DOCKER_HUB_TOKEN | jq -r '.password') || true
36+
# - docker login --username $(echo $DOCKER_HUB_TOKEN | jq -r '.username') --password $(echo $DOCKER_HUB_TOKEN | jq -r '.password') || true
4737
# increase file watcher count so CodeLens tests do not fail unexpectedly (ENOSPC error)
4838
- sysctl fs.inotify.max_user_watches=524288
39+
# start Docker
40+
# - nohup /usr/local/bin/dockerd --host=unix:///var/run/docker.sock --host=tcp://127.0.0.1:2375 --storage-driver=overlay&
41+
- timeout 15 sh -c "until docker info; do echo .; sleep 1; done"
42+
#
43+
# Prepare env for unprivileged user.
44+
#
45+
- |
46+
# - adduser --gecos GECOS --disabled-password codebuild-user
47+
mkdir ~codebuild-user || true
48+
chown -R codebuild-user:codebuild-user ~codebuild-user
49+
chown -R codebuild-user:codebuild-user .
50+
chmod +x ~codebuild-user
51+
ls -ld ~codebuild-user
52+
# Add user to "docker" group.
53+
# - usermod -aG docker codebuild-user
54+
# Ensure that "docker" group has permissions to the socket.
55+
# - chown codebuild-user /var/run/docker.sock
56+
- chmod 666 /var/run/docker.sock
4957

5058
pre_build:
59+
run-as: codebuild-user
60+
env:
61+
variables:
62+
HOME: /home/codebuild-user
5163
commands:
64+
# codebuild ignores the env.variables.HOME declaration above...?
65+
- export HOME=/home/codebuild-user
66+
- bash buildspec/setup-github-token.sh
5267
# If present, log into CodeArtifact. Provides a nice safety net in case NPM is down.
5368
# Should only affect tests run through IDEs team-hosted CodeBuild.
5469
- |
@@ -59,15 +74,29 @@ phases:
5974
echo "CodeArtifact connection failed. Falling back to npm"
6075
fi
6176
fi
62-
# make sure that SAM is in the path, is not automatically done on CodeBuild
63-
- USER_BASE_PATH=$(python -m site --user-base) && export PATH=$PATH:$USER_BASE_PATH/bin
64-
# start Docker
65-
- nohup /usr/local/bin/dockerd --host=unix:///var/run/docker.sock --host=tcp://127.0.0.1:2375 --storage-driver=overlay&
66-
- timeout 15 sh -c "until docker info; do echo .; sleep 1; done"
77+
# Where non-root "pip3 install" puts things:
78+
- 'export PATH="$HOME/.local/bin:$PATH"'
79+
- '>/dev/null pip3 install --upgrade aws-sam-cli'
80+
- '>/dev/null pip3 install --upgrade awscli'
81+
# Print info about sam (version, location, …).
82+
- 'pip3 show aws-sam-cli'
83+
- 'sam --version'
84+
# Install latest version of Go (known to 'goenv')
85+
# - eval "$(goenv init -)"
86+
# - 'export PATH="$GOROOT/bin:$PATH:$GOPATH/bin"'
87+
# - '>/dev/null VERSION=$(goenv install --list | tail -n 1) && 2>/dev/null goenv install $VERSION'
88+
# - '>/dev/null goenv global $VERSION && go env -w GOPROXY=direct'
89+
# - go version
6790

6891
build:
92+
run-as: codebuild-user
93+
env:
94+
variables:
95+
HOME: /home/codebuild-user
6996
commands:
70-
- npm ci --unsafe-perm
97+
# codebuild ignores the env.variables.HOME declaration above...?
98+
- export HOME=/home/codebuild-user
99+
- npm ci
71100
- xvfb-run npm run testInteg
72101
- VCS_COMMIT_ID="${CODEBUILD_RESOLVED_SOURCE_VERSION}"
73102
- CI_BUILD_URL=$(echo $CODEBUILD_BUILD_URL | sed 's/#/%23/g')

‎src/testInteg/sam.test.ts‎

Lines changed: 22 additions & 22 deletions
Original file line numberDiff line numberDiff line change
@@ -146,16 +146,16 @@ const scenarios: TestScenario[] = [
146146
dependencyManager: 'gradle',
147147
vscodeMinimum: '1.50.0',
148148
},
149-
{
150-
runtime: 'go1.x',
151-
displayName: 'go1.x (ZIP)',
152-
path: 'hello-world/main.go',
153-
debugSessionType: 'delve',
154-
language: 'go',
155-
dependencyManager: 'mod',
156-
// https://github.com/golang/vscode-go/blob/master/package.json
157-
vscodeMinimum: '1.67.0',
158-
},
149+
// {
150+
// runtime: 'go1.x',
151+
// displayName: 'go1.x (ZIP)',
152+
// path: 'hello-world/main.go',
153+
// debugSessionType: 'delve',
154+
// language: 'go',
155+
// dependencyManager: 'mod',
156+
// // https://github.com/golang/vscode-go/blob/master/package.json
157+
// vscodeMinimum: '1.67.0',
158+
// },
159159
// { runtime: 'dotnetcore3.1', path: 'src/HelloWorld/Function.cs', debugSessionType: 'coreclr', language: 'csharp' },
160160

161161
// images
@@ -230,17 +230,17 @@ const scenarios: TestScenario[] = [
230230
// https://github.com/microsoft/vscode-python/blob/main/package.json
231231
vscodeMinimum: '1.78.0',
232232
},
233-
{
234-
runtime: 'go1.x',
235-
displayName: 'go1.x (Image)',
236-
baseImage: 'amazon/go1.x-base',
237-
path: 'hello-world/main.go',
238-
debugSessionType: 'delve',
239-
language: 'go',
240-
dependencyManager: 'mod',
241-
// https://github.com/golang/vscode-go/blob/master/package.json
242-
vscodeMinimum: '1.67.0',
243-
},
233+
// {
234+
// runtime: 'go1.x',
235+
// displayName: 'go1.x (Image)',
236+
// baseImage: 'amazon/go1.x-base',
237+
// path: 'hello-world/main.go',
238+
// debugSessionType: 'delve',
239+
// language: 'go',
240+
// dependencyManager: 'mod',
241+
// // https://github.com/golang/vscode-go/blob/master/package.json
242+
// vscodeMinimum: '1.67.0',
243+
// },
244244
{
245245
runtime: 'java8',
246246
displayName: 'java8 (Maven Image)',
@@ -400,7 +400,7 @@ describe('SAM Integration Tests', async function () {
400400
await activateExtensions()
401401
await testUtils.configureAwsToolkitExtension()
402402
await testUtils.configurePythonExtension()
403-
await testUtils.configureGoExtension()
403+
// await testUtils.configureGoExtension()
404404

405405
testSuiteRoot = await mkdtemp(path.join(projectFolder, 'inttest'))
406406
console.log('testSuiteRoot: ', testSuiteRoot)

0 commit comments

Comments
 (0)