Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add dockerExecCommand setting #910

Merged
merged 1 commit into from
Nov 13, 2016
Merged

Add dockerExecCommand setting #910

merged 1 commit into from
Nov 13, 2016

Conversation

rbellamy
Copy link

@rbellamy rbellamy commented Nov 13, 2016

Per discussion in #903

When building docker images on CentOS, Fedora or RHEL, the permissions on /var/run/docker.socket have restricted access, preventing Docker build and push commands as a normal user from executing without severely compromising the system.

See http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/

Therefore, I've added a new setting which supports replacing the default docker shell exec command so that I can instead use sudo docker (which is the recommended method for executing Docker on CentOS, Fedora and RHEL), or completely replace the docker command with a path to a shell script.

With this new setting and the regular dockerBuildCommand and dockerBuildOptions, you get the following basics:

dockerBuildCommand := dockerExecCommand.value ++ Seq("build") ++ dockerBuildOptions.value ++ Seq(".")
// default
dockerExecCommand := Seq("docker")
// custom
dockerExecCommand := Seq("sudo", "docker")

What I don't want to do is run SBT as root - this will cause the working directory, and the ivy cache to become polluted with artifacts that are owned by root. It's best to limit the use of escalated privileges to just those commands that require them to avoid this pollution.

So, to avoid:

sudo sbt docker:publishLocal
sbt clean <=== will fail because "target" is now owned by root

…s on /var/run/docker.socket have restricted access, preventing Docker build and push commands from executing without severely compromising the system.

See http://www.projectatomic.io/blog/2015/08/why-we-dont-let-non-root-users-run-docker-in-centos-fedora-or-rhel/

Therefore, I've added a new setting which supports replacing the default docker shell exec command so that I can instead use `sudo docker`, which is the recommended method for executing Docker on CentOS, Fedora and RHEL.

What I don't want to do is run SBT as root - this will cause the working directory, and the ivy cache to become polluted with artifacts that are owned by root. It's best to limit the use of escalated privileges to just those commands that require them to avoid this pollution.

So, to avoid:

sudo sbt docker:publishLocal
sbt clean <=== will fail because "target" is now owned by root
Copy link
Contributor

@muuki88 muuki88 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks. Looks perfect.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants