Skip to content

Commit 611d6d2

Browse files
AlexeySachkovAlexeySachkov
authored
[SYCL][Devops] Fix DockerFile linting issues discovered by trivy (#16411)
This is a re-submit of #16290 with fixes from #16324 and some more extra changes. Issues addressed: - AVD-DS-0017 (HIGH): The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement. See https://avd.aquasec.com/misconfig/ds017 - AVD-DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument See https://avd.aquasec.com/misconfig/ds002 - AVD-DS-0002 (HIGH): Last USER command in Dockerfile should not be 'root' Issues remaining: - AVD-DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile See https://avd.aquasec.com/misconfig/ds026 I didn't add `HEALTHCHECK` command to our containers, because I don't know if that makes sense and which command to launch. I.e. our containers they only provide some pre-installed tools, but they don't launch any services which we could check. User creation was outlined into a separate helper script. Our containers only come with `sycl_ci` user now which requires a password to use `sudo`. However, it is still possible to get the original `sycl` user for those who uses that container locally and needs `sudo` access.
1 parent f541207 commit 611d6d2

12 files changed

+107
-65
lines changed

‎.github/workflows/sycl-linux-run-tests.yml‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -159,8 +159,8 @@ jobs:
159159
- name: Reset Intel GPU
160160
if: inputs.reset_intel_gpu == 'true'
161161
run: |
162-
sudo mount -t debugfs none /sys/kernel/debug
163-
sudo bash -c 'echo 1 > /sys/kernel/debug/dri/0/i915_wedged'
162+
cat /run/secrets/sycl_passwd | sudo -S mount -t debugfs none /sys/kernel/debug
163+
cat /run/secrets/sycl_passwd | sudo -S bash -c 'echo 1 > /sys/kernel/debug/dri/0/i915_wedged'
164164
- uses: actions/checkout@v4
165165
with:
166166
ref: ${{ inputs.ref }}
@@ -196,9 +196,9 @@ jobs:
196196
run: |
197197
if [ "${{ inputs.install_dev_igc_driver }}" = "true" ]; then
198198
# If libllvm14 is already installed (dev igc docker), still return true.
199-
sudo apt-get install -yqq libllvm14 || true;
199+
cat /run/secrets/sycl_passwd | sudo -S apt-get install -yqq libllvm14 || true;
200200
fi
201-
sudo -E bash devops/scripts/install_drivers.sh llvm/devops/dependencies.json ${{ inputs.install_dev_igc_driver == 'true' && 'llvm/devops/dependencies-igc-dev.json --use-dev-igc' || '' }} --all
201+
cat /run/secrets/sycl_passwd | sudo -S -E bash devops/scripts/install_drivers.sh llvm/devops/dependencies.json ${{ inputs.install_dev_igc_driver == 'true' && 'llvm/devops/dependencies-igc-dev.json --use-dev-igc' || '' }} --all
202202
- name: Source OneAPI TBB vars.sh
203203
shell: bash
204204
run: |

‎devops/containers/ubuntu2204_base.Dockerfile‎

Lines changed: 4 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,14 @@ USER root
88
COPY scripts/install_build_tools.sh /install.sh
99
RUN /install.sh
1010

11-
# By default Ubuntu sets an arbitrary UID value, that is different from host
12-
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
13-
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
14-
# 1001, that is used as default by GitHub Actions.
15-
RUN groupadd -g 1001 sycl && useradd sycl -u 1001 -g 1001 -m -s /bin/bash
16-
# Add sycl user to video/irc groups so that it can access GPU
17-
RUN usermod -aG video sycl
18-
RUN usermod -aG irc sycl
19-
20-
# group 109 is required for sycl user to access PVC card.
21-
RUN groupadd -g 109 render
22-
RUN usermod -aG render sycl
23-
24-
# Allow sycl user to run as sudo
25-
RUN echo "sycl ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
11+
COPY scripts/create-sycl-user.sh /user-setup.sh
12+
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
2613

2714
COPY actions/cached_checkout /actions/cached_checkout
2815
COPY actions/cleanup /actions/cleanup
2916
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
3017
COPY scripts/install_drivers.sh /opt/install_drivers.sh
3118

19+
USER sycl_ci
20+
3221
ENTRYPOINT ["/docker_entrypoint.sh"]

‎devops/containers/ubuntu2204_build.Dockerfile‎

Lines changed: 6 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -24,23 +24,18 @@ gpg --dearmor | tee /etc/apt/keyrings/rocm.gpg > /dev/null && \
2424
# Add rocm repo
2525
echo "deb [arch=amd64 signed-by=/etc/apt/keyrings/rocm.gpg] https://repo.radeon.com/rocm/apt/6.1.1 jammy main" \
2626
| tee --append /etc/apt/sources.list.d/rocm.list && \
27-
printf 'Package: *\nPin: release o=repo.radeon.com\nPin-Priority: 600' | tee /etc/apt/preferences.d/rocm-pin-600 && \
28-
apt update
27+
printf 'Package: *\nPin: release o=repo.radeon.com\nPin-Priority: 600' | tee /etc/apt/preferences.d/rocm-pin-600
2928
# Install the kernel driver
30-
RUN apt install -yqq rocm-dev && \
29+
RUN apt update && apt install -yqq rocm-dev && \
3130
apt-get clean && \
3231
rm -rf /var/lib/apt/lists/*
3332

34-
# By default Ubuntu sets an arbitrary UID value, that is different from host
35-
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
36-
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
37-
# 1001, that is used as default by GitHub Actions.
38-
RUN groupadd -g 1001 sycl && useradd sycl -u 1001 -g 1001 -m -s /bin/bash
39-
# Add sycl user to video/irc groups so that it can access GPU
40-
RUN usermod -aG video sycl
41-
RUN usermod -aG irc sycl
33+
COPY scripts/create-sycl-user.sh /user-setup.sh
34+
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
4235

4336
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
4437

38+
USER sycl_ci
39+
4540
ENTRYPOINT ["/docker_entrypoint.sh"]
4641

‎devops/containers/ubuntu2204_intel_drivers.Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ ENV DEBIAN_FRONTEND=noninteractive
77

88
ARG use_latest=true
99

10+
USER root
11+
1012
RUN apt update && apt install -yqq wget
1113

1214
COPY scripts/get_release.py /
@@ -25,5 +27,7 @@ RUN --mount=type=secret,id=github_token \
2527

2628
COPY scripts/drivers_entrypoint.sh /drivers_entrypoint.sh
2729

30+
USER sycl_ci
31+
2832
ENTRYPOINT ["/bin/bash", "/drivers_entrypoint.sh"]
2933

‎devops/containers/ubuntu2204_preinstalled.Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -3,12 +3,16 @@ ARG base_image=ghcr.io/intel/llvm/ubuntu2204_intel_drivers
33

44
FROM $base_image:$base_tag
55

6+
USER root
7+
68
COPY scripts/drivers_entrypoint.sh /drivers_entrypoint.sh
79
RUN mkdir -p /opt/sycl
810
ADD sycl_linux.tar.gz /opt/sycl/
911

1012
ENV PATH /opt/sycl/bin:$PATH
1113
ENV LD_LIBRARY_PATH /opt/sycl/lib:$LD_LIBRARY_PATH
1214

15+
USER sycl_ci
16+
1317
ENTRYPOINT ["/bin/bash", "/drivers_entrypoint.sh"]
1418

‎devops/containers/ubuntu2404_base.Dockerfile‎

Lines changed: 4 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -8,25 +8,14 @@ USER root
88
COPY scripts/install_build_tools.sh /install.sh
99
RUN /install.sh
1010

11-
# By default Ubuntu sets an arbitrary UID value, that is different from host
12-
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
13-
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
14-
# 1001, that is used as default by GitHub Actions.
15-
RUN groupadd -g 1001 sycl && useradd sycl -u 1001 -g 1001 -m -s /bin/bash
16-
# Add sycl user to video/irc groups so that it can access GPU
17-
RUN usermod -aG video sycl
18-
RUN usermod -aG irc sycl
19-
20-
# group 109 is required for sycl user to access PVC card.
21-
RUN groupadd -g 109 render
22-
RUN usermod -aG render sycl
23-
24-
# Allow sycl user to run as sudo
25-
RUN echo "sycl ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
11+
COPY scripts/create-sycl-user.sh /user-setup.sh
12+
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
2613

2714
COPY actions/cached_checkout /actions/cached_checkout
2815
COPY actions/cleanup /actions/cleanup
2916
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
3017
COPY scripts/install_drivers.sh /opt/install_drivers.sh
3118

19+
USER sycl_ci
20+
3221
ENTRYPOINT ["/docker_entrypoint.sh"]

‎devops/containers/ubuntu2404_build_oneapi.Dockerfile‎

Lines changed: 7 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -31,23 +31,19 @@ echo -e 'Package: *\nPin: release o=repo.radeon.com\nPin-Priority: 600' \
3131
wget -O- https://apt.repos.intel.com/intel-gpg-keys/GPG-PUB-KEY-INTEL-SW-PRODUCTS.PUB | gpg --dearmor \
3232
| tee /usr/share/keyrings/oneapi-archive-keyring.gpg > /dev/null && \
3333
echo "deb [signed-by=/usr/share/keyrings/oneapi-archive-keyring.gpg] https://apt.repos.intel.com/oneapi all main" \
34-
| tee /etc/apt/sources.list.d/oneAPI.list && \
35-
apt update
34+
| tee /etc/apt/sources.list.d/oneAPI.list
35+
3636
# Install the ROCM kernel driver and oneAPI
37-
RUN apt install -yqq rocm-dev intel-oneapi-compiler-dpcpp-cpp && \
37+
RUN apt update && apt install -yqq rocm-dev intel-oneapi-compiler-dpcpp-cpp && \
3838
apt-get clean && \
3939
rm -rf /var/lib/apt/lists/*
4040

41-
# By default Ubuntu sets an arbitrary UID value, that is different from host
42-
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
43-
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
44-
# 1001, that is used as default by GitHub Actions.
45-
RUN groupadd -g 1001 sycl && useradd sycl -u 1001 -g 1001 -m -s /bin/bash
46-
# Add sycl user to video/irc groups so that it can access GPU
47-
RUN usermod -aG video sycl
48-
RUN usermod -aG irc sycl
41+
COPY scripts/create-sycl-user.sh /user-setup.sh
42+
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
4943

5044
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
5145

46+
USER sycl_ci
47+
5248
ENTRYPOINT ["/docker_entrypoint.sh"]
5349

‎devops/containers/ubuntu2404_intel_drivers.Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,8 @@ ENV DEBIAN_FRONTEND=noninteractive
77

88
ARG use_latest=true
99

10+
USER root
11+
1012
RUN apt update && apt install -yqq wget
1113

1214
COPY scripts/get_release.py /
@@ -25,5 +27,7 @@ RUN --mount=type=secret,id=github_token \
2527

2628
COPY scripts/drivers_entrypoint.sh /drivers_entrypoint.sh
2729

30+
USER sycl_ci
31+
2832
ENTRYPOINT ["/bin/bash", "/drivers_entrypoint.sh"]
2933

‎devops/containers/ubuntu2404_intel_drivers_igc_dev.Dockerfile‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -5,6 +5,8 @@ FROM $base_image:$base_tag
55

66
ENV DEBIAN_FRONTEND=noninteractive
77

8+
USER root
9+
810
RUN apt update && apt install -yqq libllvm14
911

1012
COPY scripts/get_release.py /
@@ -20,5 +22,7 @@ RUN --mount=type=secret,id=github_token \
2022

2123
COPY scripts/drivers_entrypoint.sh /drivers_entrypoint.sh
2224

25+
USER sycl_ci
26+
2327
ENTRYPOINT ["/bin/bash", "/drivers_entrypoint.sh"]
2428

‎devops/scripts/create-sycl-user.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/bash
2+
3+
set -e
4+
5+
if [[ $# -eq 0 ]]; then
6+
# When launched without arguments, we assume that it was launched as part of
7+
# CI workflow and therefore a different kind of user is created
8+
USER_NAME=sycl_ci
9+
SET_PASSWD=true
10+
11+
# By default Ubuntu sets an arbitrary UID value, that is different from host
12+
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
13+
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
14+
# 1001, that is used as default by GitHub Actions.
15+
USER_ID=1001
16+
else
17+
if [[ "${1:-}" != "--regular" ]]; then
18+
echo "The only supported argument is --regular!"
19+
exit 1
20+
fi
21+
USER_NAME=sycl
22+
SET_PASSWD=false
23+
24+
# Some user id which is different from the one assigned to sycl_ci user
25+
USER_ID=1234
26+
fi
27+
28+
groupadd -g $USER_ID $USER_NAME && useradd $USER_NAME -u $USER_ID -g $USER_ID -m -s /bin/bash
29+
# Add user to video/irc groups so that it can access GPU
30+
usermod -aG video $USER_NAME
31+
usermod -aG irc $USER_NAME
32+
33+
# group 109 is required for user to access PVC card.
34+
groupadd -f -g 109 render
35+
usermod -aG render $USER_NAME
36+
37+
if [[ $SET_PASSWD == true ]]; then
38+
if [[ ! -f /run/secrets/sycl_ci_passwd ]]; then
39+
echo "Password is requested, but /run/secrets/sycl_ci_passwd doesn't exist!"
40+
exit 2
41+
fi
42+
43+
# Set password for user
44+
echo "$USER_NAME:$(cat /run/secrets/sycl_ci_passwd)" | chpasswd
45+
46+
# Allow user to run as sudo, but only with password
47+
echo "$USER_NAME ALL=(ALL) PASSWD:ALL" >> /etc/sudoers
48+
else
49+
echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
50+
fi

0 commit comments

Comments
 (0)