Merge branch 'main' into fix/revert-nifi-version-change

Author: sbernauer

CHANGELOG.md

@@ -92,10 +92,10 @@ All notable changes to this project will be documented in this file.
 - opa: Enable custom versions ([#1170]).
 - use custom product versions for Hadoop, HBase, Phoenix, hbase-operator-tools, Druid, Hive and Spark ([#1173]).
 - hbase: Bump dependencies to the latest patch level for HBase `2.6.1` and `2.6.2` ([#1185]).
-- Changed default user & group IDs from 1000/1000 to 782252253/574654813 ([#1164])
 - ubi-rust-builder: Bump Rust toolchain to 1.87.0, cargo-auditable to 0.7.0 and protoc to 31.1 ([#1197]).
 - stackable-base, stackable-devel, ubi-rust-builder: Update `ubi-minimal` base image ([#1197]).
 - testing-tools: Update `python` 3.12-slim-bullseye base image ([#1197]).
+- Change default user & group IDs to 1000/0 ([#1193]).
 
 ### Fixed
 
@@ -204,7 +204,6 @@ All notable changes to this project will be documented in this file.
 [#1156]: https://github.com/stackabletech/docker-images/pull/1156
 [#1159]: https://github.com/stackabletech/docker-images/pull/1159
 [#1163]: https://github.com/stackabletech/docker-images/pull/1163
-[#1164]: https://github.com/stackabletech/docker-images/pull/1164
 [#1165]: https://github.com/stackabletech/docker-images/pull/1165
 [#1168]: https://github.com/stackabletech/docker-images/pull/1168
 [#1169]: https://github.com/stackabletech/docker-images/pull/1169
@@ -219,6 +218,7 @@ All notable changes to this project will be documented in this file.
 [#1185]: https://github.com/stackabletech/docker-images/pull/1185
 [#1188]: https://github.com/stackabletech/docker-images/pull/1188
 [#1189]: https://github.com/stackabletech/docker-images/pull/1189
+[#1193]: https://github.com/stackabletech/docker-images/pull/1193
 [#1197]: https://github.com/stackabletech/docker-images/pull/1197
 
 ## [25.3.0] - 2025-03-21

conf.py

@@ -108,7 +108,7 @@
 
 args = {
     "STACKABLE_USER_NAME": "stackable",
-    "STACKABLE_USER_UID": "782252253",  # This is a random high id to not conflict with any existing user
-    "STACKABLE_USER_GID": "574654813",  # This is a random high id to not conflict with any existing group
+    "STACKABLE_USER_UID": "1000",
+    "STACKABLE_USER_GID": "0",
     "DELETE_CACHES": "true",
 }

hadoop/Dockerfile

@@ -191,7 +191,10 @@ FROM stackable/image/java-base AS final
 
 ARG PRODUCT
 ARG RELEASE
+ARG TARGETARCH
+ARG TARGETOS
 ARG HDFS_UTILS
+ARG ASYNC_PROFILER
 ARG STACKABLE_USER_UID
 
 LABEL \
@@ -203,7 +206,13 @@ LABEL \
     summary="The Stackable image for Apache Hadoop." \
     description="This image is deployed by the Stackable Operator for Apache Hadoop / HDFS."
 
-COPY --chown=${STACKABLE_USER_UID}:0 --from=hadoop-builder /stackable /stackable
+
+COPY --chown=${STACKABLE_USER_UID}:0 --from=hadoop-builder /stackable/hadoop-${PRODUCT}-stackable${RELEASE} /stackable/hadoop-${PRODUCT}-stackable${RELEASE}
+COPY --chown=${STACKABLE_USER_UID}:0 --from=hadoop-builder /stackable/hadoop-${PRODUCT}-stackable${RELEASE}-src.tar.gz /stackable/
+COPY --chown=${STACKABLE_USER_UID}:0 --from=hadoop-builder /stackable/async-profiler-${ASYNC_PROFILER}-* /stackable/async-profiler-${ASYNC_PROFILER}
+COPY --chown=${STACKABLE_USER_UID}:0 --from=hadoop-builder /stackable/jmx /stackable/jmx
+COPY --chown=${STACKABLE_USER_UID}:0 --from=hadoop-builder /stackable/protobuf-*-src.tar.gz /stackable/
+
 COPY --chown=${STACKABLE_USER_UID}:0 --from=hdfs-utils-builder /stackable/hdfs-utils-${HDFS_UTILS}.jar /stackable/hadoop-${PRODUCT}-stackable${RELEASE}/share/hadoop/common/lib/hdfs-utils-${HDFS_UTILS}.jar
 COPY --chown=${STACKABLE_USER_UID}:0 --from=hdfs-utils-builder /stackable/hdfs-utils-${HDFS_UTILS}-src.tar.gz /stackable
 
@@ -230,7 +239,20 @@ rm -rf /var/cache/yum
 # Without this fuse_dfs does not work
 # It is so non-root users (as we are) can mount a FUSE device and let other users access it
 echo "user_allow_other" > /etc/fuse.conf
-EOF
+
+ln -s "/stackable/hadoop-${PRODUCT}-stackable${RELEASE}" /stackable/hadoop
+chown --no-dereference "${STACKABLE_USER_UID}:0" /stackable/hadoop
+chmod g=u "/stackable/hadoop-${PRODUCT}-stackable${RELEASE}"
+chmod g=u /stackable/*-src.tar.gz
+
+ARCH="${TARGETARCH/amd64/x64}"
+mv /stackable/async-profiler-${ASYNC_PROFILER}* "/stackable/async-profiler-${ASYNC_PROFILER-}-${TARGETOS}-${ARCH}"
+chmod g=u "/stackable/async-profiler-${ASYNC_PROFILER-}-${TARGETOS}-${ARCH}"
+ln -s "/stackable/async-profiler-${ASYNC_PROFILER}-${TARGETOS}-${ARCH}" /stackable/async-profiler
+chown --no-dereference "${STACKABLE_USER_UID}:0" /stackable/async-profiler
+
+chmod g=u /stackable/jmx
+
 
 # ----------------------------------------
 # Checks
@@ -241,7 +263,6 @@ EOF
 
 # Check that permissions and ownership in /stackable are set correctly
 # This will fail and stop the build if any mismatches are found.
-RUN <<EOF
 /bin/check-permissions-ownership.sh /stackable ${STACKABLE_USER_UID} 0
 EOF
 

shared/checks/check-permissions-ownership.sh

@@ -27,6 +27,8 @@ EXPECTED_UID=$2
 EXPECTED_GID=$3
 
 error_flag=0
+ownership_errors=0
+permission_errors=0
 
 # Check ownership
 while IFS= read -r -d '' entry; do
@@ -38,6 +40,7 @@ while IFS= read -r -d '' entry; do
         file=${remainder#* }
         echo "Ownership mismatch:  $file (Expected: $EXPECTED_UID:$EXPECTED_GID, Found: $uid:$gid)"
         error_flag=1
+        ((ownership_errors++))
     fi
 done < <(find "$DIRECTORY" -printf "%U %G %p\0")
 
@@ -48,13 +51,15 @@ while IFS= read -r -d '' entry; do
 
     if [[ "$owner_perms" != "$group_perms" ]]; then
         file="${entry:11}"
-        echo "Permission mismatch: $file (Owner: $owner_perms, Group: $group_perms)"
+        echo "Permission mismatch: $file (Owner: $owner_perms, Group: $group_perms, Expected: owner=group)"
         error_flag=1
+        ((permission_errors++))
     fi
 done < <(find "$DIRECTORY" -printf "%M %p\0")
 
 if [[ $error_flag -ne 0 ]]; then
     echo "Permission and Ownership checks failed for $DIRECTORY!"
+    echo "Found $ownership_errors ownership mismatches and $permission_errors permission mismatches"
     exit 1
 fi