Skip to content

Commit 8aba7b1

Browse files
AlexeySachkovAlexeySachkov
authored
[SYCL][Devops] Revert requiring password for sudo (intel#16438)
Apparently, I overlooked part of the documentation saying that docker secrets are only available for containers running as a service which isn't the case for our build/test CI pipeline. Therefore, I'm partially reverting intel#16411 so that our containers once again use `sycl` user which has password-less `sudo` access. This PR also reverts intel#16436 to re-enable GPU reset.
1 parent 38b5829 commit 8aba7b1

File tree

9 files changed

+23
-66
lines changed

9 files changed

+23
-66
lines changed

‎.github/workflows/sycl-containers.yaml‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -82,7 +82,6 @@ jobs:
8282
file: ${{ matrix.file }}
8383
username: ${{ github.repository_owner }}
8484
password: ${{ secrets.GITHUB_TOKEN }}
85-
sycl_ci_passwd: ${{ secrets.DOCKER_SUDO_PASSWORD }}
8685
tags: |
8786
ghcr.io/${{ github.repository }}/${{ matrix.file }}:${{ matrix.tag }}-${{ github.sha }}
8887
ghcr.io/${{ github.repository }}/${{ matrix.file }}:${{ matrix.tag }}

‎.github/workflows/sycl-linux-run-tests.yml‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -157,10 +157,10 @@ jobs:
157157
env: ${{ fromJSON(inputs.env) }}
158158
steps:
159159
- name: Reset Intel GPU
160-
if: false
160+
if: inputs.reset_intel_gpu == 'true'
161161
run: |
162-
cat /run/secrets/sycl_passwd | sudo -S mount -t debugfs none /sys/kernel/debug
163-
cat /run/secrets/sycl_passwd | sudo -S bash -c 'echo 1 > /sys/kernel/debug/dri/0/i915_wedged'
162+
sudo -S mount -t debugfs none /sys/kernel/debug
163+
sudo -S bash -c 'echo 1 > /sys/kernel/debug/dri/0/i915_wedged'
164164
- uses: actions/checkout@v4
165165
with:
166166
ref: ${{ inputs.ref }}
@@ -196,9 +196,9 @@ jobs:
196196
run: |
197197
if [ "${{ inputs.install_dev_igc_driver }}" = "true" ]; then
198198
# If libllvm14 is already installed (dev igc docker), still return true.
199-
cat /run/secrets/sycl_passwd | sudo -S apt-get install -yqq libllvm14 || true;
199+
sudo -S apt-get install -yqq libllvm14 || true;
200200
fi
201-
cat /run/secrets/sycl_passwd | sudo -S -E bash devops/scripts/install_drivers.sh llvm/devops/dependencies.json ${{ inputs.install_dev_igc_driver == 'true' && 'llvm/devops/dependencies-igc-dev.json --use-dev-igc' || '' }} --all
201+
sudo -S -E bash devops/scripts/install_drivers.sh llvm/devops/dependencies.json ${{ inputs.install_dev_igc_driver == 'true' && 'llvm/devops/dependencies-igc-dev.json --use-dev-igc' || '' }} --all
202202
- name: Source OneAPI TBB vars.sh
203203
shell: bash
204204
run: |

‎devops/actions/build_container/action.yml‎

Lines changed: 0 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -21,9 +21,6 @@ inputs:
2121
file:
2222
description: "Dockerfile"
2323
required: true
24-
sycl_ci_passwd:
25-
description: "Password to assign to sycl_ci user within a container"
26-
required: true
2724

2825
runs:
2926
using: "composite"
@@ -44,4 +41,3 @@ runs:
4441
file: ${{ github.workspace }}/devops/containers/${{ inputs.file }}.Dockerfile
4542
secrets: |
4643
github_token=${{ github.token }}
47-
sycl_ci_passwd=${{ inputs.sycl_ci_passwd }}

‎devops/containers/ubuntu2204_base.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ COPY scripts/install_build_tools.sh /install.sh
99
RUN /install.sh
1010

1111
COPY scripts/create-sycl-user.sh /user-setup.sh
12-
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
12+
RUN /user-setup.sh
1313

1414
COPY actions/cached_checkout /actions/cached_checkout
1515
COPY actions/cleanup /actions/cleanup
1616
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
1717
COPY scripts/install_drivers.sh /opt/install_drivers.sh
1818

19-
USER sycl_ci
19+
USER sycl
2020

2121
ENTRYPOINT ["/docker_entrypoint.sh"]

‎devops/containers/ubuntu2204_build.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -31,11 +31,11 @@ RUN apt update && apt install -yqq rocm-dev && \
3131
rm -rf /var/lib/apt/lists/*
3232

3333
COPY scripts/create-sycl-user.sh /user-setup.sh
34-
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
34+
RUN /user-setup.sh
3535

3636
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
3737

38-
USER sycl_ci
38+
USER sycl
3939

4040
ENTRYPOINT ["/docker_entrypoint.sh"]
4141

‎devops/containers/ubuntu2404_base.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,13 +9,13 @@ COPY scripts/install_build_tools.sh /install.sh
99
RUN /install.sh
1010

1111
COPY scripts/create-sycl-user.sh /user-setup.sh
12-
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
12+
RUN /user-setup.sh
1313

1414
COPY actions/cached_checkout /actions/cached_checkout
1515
COPY actions/cleanup /actions/cleanup
1616
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
1717
COPY scripts/install_drivers.sh /opt/install_drivers.sh
1818

19-
USER sycl_ci
19+
USER sycl
2020

2121
ENTRYPOINT ["/docker_entrypoint.sh"]

‎devops/containers/ubuntu2404_build_oneapi.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -39,11 +39,11 @@ RUN apt update && apt install -yqq rocm-dev intel-oneapi-compiler-dpcpp-cpp && \
3939
rm -rf /var/lib/apt/lists/*
4040

4141
COPY scripts/create-sycl-user.sh /user-setup.sh
42-
RUN --mount=type=secret,id=sycl_ci_passwd /user-setup.sh
42+
RUN /user-setup.sh
4343

4444
COPY scripts/docker_entrypoint.sh /docker_entrypoint.sh
4545

46-
USER sycl_ci
46+
USER sycl
4747

4848
ENTRYPOINT ["/docker_entrypoint.sh"]
4949

‎devops/scripts/create-sycl-user.sh‎

Lines changed: 8 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -2,28 +2,13 @@
22

33
set -e
44

5-
if [[ $# -eq 0 ]]; then
6-
# When launched without arguments, we assume that it was launched as part of
7-
# CI workflow and therefore a different kind of user is created
8-
USER_NAME=sycl_ci
9-
SET_PASSWD=true
5+
USER_NAME=sycl
106

11-
# By default Ubuntu sets an arbitrary UID value, that is different from host
12-
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
13-
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
14-
# 1001, that is used as default by GitHub Actions.
15-
USER_ID=1001
16-
else
17-
if [[ "${1:-}" != "--regular" ]]; then
18-
echo "The only supported argument is --regular!"
19-
exit 1
20-
fi
21-
USER_NAME=sycl
22-
SET_PASSWD=false
23-
24-
# Some user id which is different from the one assigned to sycl_ci user
25-
USER_ID=1234
26-
fi
7+
# By default Ubuntu sets an arbitrary UID value, that is different from host
8+
# system. When CI passes default UID value of 1001, some of LLVM tools fail to
9+
# discover user home directory and fail a few LIT tests. Fixes UID and GID to
10+
# 1001, that is used as default by GitHub Actions.
11+
USER_ID=1001
2712

2813
groupadd -g $USER_ID $USER_NAME && useradd $USER_NAME -u $USER_ID -g $USER_ID -m -s /bin/bash
2914
# Add user to video/irc groups so that it can access GPU
@@ -34,17 +19,5 @@ usermod -aG irc $USER_NAME
3419
groupadd -f -g 109 render
3520
usermod -aG render $USER_NAME
3621

37-
if [[ $SET_PASSWD == true ]]; then
38-
if [[ ! -f /run/secrets/sycl_ci_passwd ]]; then
39-
echo "Password is requested, but /run/secrets/sycl_ci_passwd doesn't exist!"
40-
exit 2
41-
fi
42-
43-
# Set password for user
44-
echo "$USER_NAME:$(cat /run/secrets/sycl_ci_passwd)" | chpasswd
45-
46-
# Allow user to run as sudo, but only with password
47-
echo "$USER_NAME ALL=(ALL) PASSWD:ALL" >> /etc/sudoers
48-
else
49-
echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers
50-
fi
22+
# Allow user to run as sudo (without a password)
23+
echo "$USER_NAME ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

‎sycl/doc/developer/DockerBKMs.md‎

Lines changed: 2 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -143,23 +143,12 @@ instructions.
143143

144144
## Changing Docker user
145145

146-
By default all processes within our containers are run as the `sycl_ci` user.
147-
Note: it **does not** have password-less `root` access.
146+
By default all processes within our containers are run as the `sycl` user which
147+
has password-less `sudo` access.
148148

149149
If you want to change the user, you can do that by specifying the
150150
`-u <username or uid>` option when running the container.
151151

152-
All containers come with the `/user-setup.sh` script which can used to create
153-
the `sycl` user which has all the same groups as the `sycl_ci` user, but also
154-
has password-less access to `root`. Use the script as follows:
155-
156-
```bash
157-
# Note: the script requires root permissions to create a new user
158-
/user-setup.sh --regular
159-
# Switch to the newly created user
160-
su - sycl
161-
```
162-
163152
## Managing downloaded Docker images
164153

165154
List local images:

0 commit comments

Comments
 (0)