WIP Work around arbitrary user IDs on OpenShift #13561

amisevsk · 2019-06-17T19:44:06Z

What does this PR do?

Add the workspace attribute supportArbitraryUser to enable an attempt at working around containers running with arbitrary user ID on OpenShift.

When the attribute is set to true, Che will modify the recipe containers' command and arguments to attempt to add an entry to /etc/passwd for the current user ID. This resolves various problems around programs that depend on username being available when running (e.g. maven, bash).

If the command fails (e.g. because /etc/passwd is not writable), the original container command will still execute.

Note that this PR does not fully resolve #13454 since most default images do not have a root group writable /etc/passwd.

Testing

To test you will need to use an image with a writeable /etc/passwd:

Modified Java Maven devfile

  metadata:
    name: maven-s2i
  projects: []
  attributes:
    persistVolumes: 'true'
    supportArbitraryUser: 'true'
  components:
    - mountSources: false
      endpoints: []
      command: []
      id: redhat/java/latest
      args: []
      preferences: {}
      selector: {}
      type: chePlugin
      entrypoints: []
      volumes: []
      env: []
    - mountSources: true
      endpoints:
        - name: 8080/tcp
          port: 8080
          attributes: {}
      command:
        - sleep
      args:
        - infinity
      memoryLimit: 512Mi
      preferences: {}
      selector: {}
      type: dockerimage
      entrypoints: []
      volumes:
        - name: m2
          containerPath: /home/user/.m2
      image: 'fabric8/s2i-java:latest-java11'
      alias: maven
      env:
        - value: /home/user/.m2
          name: MAVEN_CONFIG
        - value: >-
            -XX:MaxRAMPercentage=50 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10
            -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4
            -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true
            -Xms20m -Djava.security.egd=file:/dev/./urandom -Duser.home=/home/user
          name: MAVEN_OPTS
        - value: >-
            -XX:MaxRAMPercentage=50 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10
            -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4
            -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true
            -Xms20m -Djava.security.egd=file:/dev/./urandom
          name: JAVA_OPTS
        - value: >-
            -XX:MaxRAMPercentage=50 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10
            -XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4
            -XX:AdaptiveSizePolicyWeight=90 -Dsun.zip.disableMemoryMapping=true
            -Xms20m -Djava.security.egd=file:/dev/./urandom
          name: JAVA_TOOL_OPTIONS
        - value: '$(echo ${0})\\$'
          name: PS1
        - value: /home/user
          name: HOME
  apiVersion: 1.0.0
  commands: []

What issues does this PR fix or reference?

#13454

Docs PR

TODO

ibuziuk · 2019-06-18T14:51:55Z

Tested with the following dev-file (should be a replacement of the Vaadin factory from getting started [1])

apiVersion: 1.0.0
metadata:
name: vaadin-addressbook
attributes:
persistVolumes: 'false'
supportArbitraryUser: 'true'
projects:

name: addressbook
source:
type: git
location: 'https://github.com/vaadin/addressbook'
components:

type: chePlugin
id: redhat/java/latest

type: dockerimage
alias: maven
image: fabric8/s2i-java:latest-java11
command: ['sleep']
args: ['infinity']
env:

name: MAVEN_CONFIG
value: /home/user/.m2

name: MAVEN_OPTS
value: "-XX:MaxRAMPercentage=50 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10
-XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90
-Dsun.zip.disableMemoryMapping=true -Xms20m -Djava.security.egd=file:/dev/./urandom
-Duser.home=/home/user"

name: JAVA_OPTS
value: "-XX:MaxRAMPercentage=50 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10
-XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90
-Dsun.zip.disableMemoryMapping=true -Xms20m -Djava.security.egd=file:/dev/./urandom"

name: JAVA_TOOL_OPTIONS
value: "-XX:MaxRAMPercentage=50 -XX:+UseParallelGC -XX:MinHeapFreeRatio=10
-XX:MaxHeapFreeRatio=20 -XX:GCTimeRatio=4 -XX:AdaptiveSizePolicyWeight=90
-Dsun.zip.disableMemoryMapping=true -Xms20m -Djava.security.egd=file:/dev/./urandom"

name: PS1
value: $(echo ${0})\$

name: HOME
value: /home/user
memoryLimit: 512Mi
endpoints:

name: '8080/tcp'
port: 8080
mountSources: true
volumes:

name: m2
containerPath: /home/user/.m2
commands:

name: run
actions:

type: exec
component: maven
command: "mvn -f ${CHE_PROJECTS_ROOT}/addressbook jetty:run"

name: stop
actions:

type: exec
component: maven
command: "mvn -f ${CHE_PROJECTS_ROOT}/addressbook jetty:stop"

As @amisevsk mentioned the approach will work only if /etc/passwd is writable which is not the case for most of the images e.g. maven:3.6.0-jdk-11 and even with this fix we will need to use images like s2i e.g. fabric8/s2i-java:latest-java11 with writable /etc/passwd

I tested against fabric8/s2i-java:latest-java11 and maven:3.6.0-jdk-11

output for the s2i based:

bash-4.2$ whoami
user

output for maven:3.6.0-jdk-11 still:

sh$whoami
whoami: cannot find name for user ID 1000880000

In any case, this is a great enchantment 👍 but we still need to think about the language runtime images we would use.

[1] https://www.eclipse.org/che/getting-started/cloud/

sleshchenko

Should we have an ability to configure default supportArbitraryUser value for all workspaces with property and then override default behavior with workspace attributes?
I've checked and supportArbitraryUser attribute can be specified in Devfile. Should it be listed in Devfile document? Somewhere here https://github.com/eclipse/che/blob/master/wsmaster/che-core-api-workspace/src/main/resources/schema/devfile.json, https://github.com/eclipse/che/blob/master/wsmaster/che-core-api-workspace/README-devfile.md

...rg/eclipse/che/workspace/infrastructure/openshift/provision/OpenShiftCommandProvisioner.java

sleshchenko · 2019-06-19T12:46:40Z

...-core-api-workspace-shared/src/main/java/org/eclipse/che/api/workspace/shared/Constants.java

+   * OpenShift default of starting containers with an arbitrary UID. Should be set/read from {@link
+   * WorkspaceConfig#getAttributes()}.
+   *
+   * <p>Value is expected to be boolean; if it is set to 'true', then the recipe containers in the


Can you elaborate on why only recipe containers should be affected?

There are a few reasons I want to keep it to recipe containers only.

It's kind of a rough proxy for only affecting user-specified containers; we don't want to run the provisioner for broker containers.

I tried to keep this PR a relatively minimal set of changes. The issue we're trying to solve affects workspace containers primarily and so I focussed on those. If similar issues exist for typical sidecar containers then we could include those as well. I'd generally prefer to not rewrite commands unless we have to since it introduces potential errors and issues

Additionally, our plugin runner containers don't specify a command/argument so this wouldn't work (it would actually break workspaces since the entrypoint would no longer be terminating)

Since plugin runner containers and similar are 'write once, run everywhere' containers, I think a better solution if a similar change is needed is to create the containers with the fixes built in. We control those dockerfiles and entrypoints already so a kind of sloppy work around is not necessary.

This does bring up a good point though; I think this PR as it currently is will break the devfile demo, since the db container doesn't list an entrypoint. I'll have to address that (only do the overwriting if there is an command specified.

amisevsk · 2019-06-19T14:40:17Z

@sleshchenko Regarding the other comments

I'm open to allowing a config property to specify the default here when no attribute is present, but worry that it could make debugging issues more difficult (it's another config setting we have to be aware of when figuring out what's wrong) and also without a UI aspect it could confuse users.
Good point around documentation, I will add that.

l0rd

LGTM I like @sleshchenko idea to make it configurable at wsmaster level but @amisevsk you have a good point as well. I would consider it for another PR after GA.

amisevsk · 2019-06-20T03:32:50Z

ci-test

che-bot · 2019-06-20T06:35:44Z

Results of automated E2E tests of Eclipse Che Multiuser on OCP:
Build details
Test report
docker image: eclipseche/che-server:13561
https://github.com/orgs/eclipse/teams/eclipse-che-qa please check this report.

Add the workspace attribute 'supportArbitraryUser' to enable an attempt at working around containers running with arbitrary user ID on OpenShift. When the attribute is set to 'true', Che will modify the recipe containers' command and arguments to attempt to add an entry to /etc/passwd for the current user ID. This resolves various problems around programs that depend on username being available when running (e.g. maven, bash). If the command fails (e.g. because /etc/passwd is not writable), the original container command will still execute. Signed-off-by: Angel Misevski <[email protected]>

ibuziuk · 2019-07-02T18:12:32Z

It was decided to put this PR on hold and reconsider after Che 7 GA release. An alternative solution for GA is to patch existing community images and make them OpenShift compatible - eclipse-che/che-devfile-registry#24

amisevsk · 2019-07-15T15:28:08Z

+1 on @ibuziuk's comment, this PR is not good enough for many images (since /etc/passwd is typically not writeable and images with writable /etc/passwd are not commonly available -- it is hard to find compatible images).

sunix · 2019-07-15T15:40:29Z

could we somehow mount /etc/passwd ?

amisevsk · 2019-07-15T16:41:20Z

@sunix That was the post-7.0 plan -- try to do an overlay that is writeable.

amisevsk · 2019-08-21T03:20:54Z

Closing this PR as current understanding of the issue means this fix won't work (most images don't have a writable /etc/passwd). Solving this problem would be an entirely new PR.

amisevsk added the kind/enhancement A feature request - must adhere to the feature request template. label Jun 17, 2019

amisevsk requested review from l0rd, ibuziuk and sleshchenko June 17, 2019 19:44

amisevsk requested review from metlos and skabashnyuk as code owners June 17, 2019 19:44

ibuziuk approved these changes Jun 18, 2019

View reviewed changes

ibuziuk mentioned this pull request Jun 19, 2019

Add a nodejs stack eclipse-che/che-devfile-registry#15

Merged

sleshchenko reviewed Jun 19, 2019

View reviewed changes

l0rd approved these changes Jun 19, 2019

View reviewed changes

amisevsk requested a review from mshaposhnik as a code owner June 20, 2019 03:32

sleshchenko approved these changes Jun 20, 2019

View reviewed changes

amisevsk force-pushed the command-provision branch from 8e5117c to 9963f94 Compare June 20, 2019 18:07

This was referenced Jun 21, 2019

Maven dependencies are download each time the workspace is getting restarted #13603

Closed

.m2 dependencies are getting stored in a '?' folder in the project #13610

Closed

amisevsk changed the title ~~Work around arbitrary user IDs on OpenShift~~ WIP Work around arbitrary user IDs on OpenShift Jun 27, 2019

che-bot added the status/code-review This issue has a pull request posted for it and is awaiting code review completion by the community. label Jun 27, 2019

eclipse-che deleted a comment from che-bot Aug 6, 2019

amisevsk closed this Aug 21, 2019

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

WIP Work around arbitrary user IDs on OpenShift #13561

WIP Work around arbitrary user IDs on OpenShift #13561

amisevsk commented Jun 17, 2019

ibuziuk commented Jun 18, 2019

sleshchenko left a comment

sleshchenko Jun 19, 2019

amisevsk Jun 19, 2019

amisevsk commented Jun 19, 2019

l0rd left a comment

amisevsk commented Jun 20, 2019

che-bot commented Jun 20, 2019

ibuziuk commented Jul 2, 2019

amisevsk commented Jul 15, 2019

sunix commented Jul 15, 2019

amisevsk commented Jul 15, 2019

amisevsk commented Aug 21, 2019

WIP Work around arbitrary user IDs on OpenShift #13561

WIP Work around arbitrary user IDs on OpenShift #13561

Conversation

amisevsk commented Jun 17, 2019

What does this PR do?

Testing

What issues does this PR fix or reference?

Docs PR

ibuziuk commented Jun 18, 2019

sleshchenko left a comment

Choose a reason for hiding this comment

sleshchenko Jun 19, 2019

Choose a reason for hiding this comment

amisevsk Jun 19, 2019

Choose a reason for hiding this comment

amisevsk commented Jun 19, 2019

l0rd left a comment

Choose a reason for hiding this comment

amisevsk commented Jun 20, 2019

che-bot commented Jun 20, 2019

ibuziuk commented Jul 2, 2019

amisevsk commented Jul 15, 2019

sunix commented Jul 15, 2019

amisevsk commented Jul 15, 2019

amisevsk commented Aug 21, 2019