ml
36 lines
1.6 KiB
Bash
Executable File
36 lines
1.6 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# Drops from root (needed to read the Go toolchain and module cache under
|
|
# /usr/local/go and /opt/go) to a user matching the host's UID/GID, so
|
|
# anything written into the bind-mounted repo (hacked/_build/, ...) is owned
|
|
# by the host user instead of root.
|
|
set -euo pipefail
|
|
|
|
USER_UID="${HOST_UID:-1000}"
|
|
USER_GID="${HOST_GID:-1000}"
|
|
|
|
groupadd -g "$USER_GID" builder 2>/dev/null || true
|
|
useradd -u "$USER_UID" -g "$USER_GID" -m -s /bin/bash builder 2>/dev/null || true
|
|
|
|
# /workspace (the bind-mounted repo) may actually be owned by a group the
|
|
# host user only has via *supplementary* membership rather than their
|
|
# primary GID above - e.g. a VirtualBox vboxsf shared folder, which shows
|
|
# up as root:vboxsf on the host and would otherwise be inaccessible to
|
|
# `builder` here (falls through to "other", which vboxsf's default mode
|
|
# leaves with no permissions at all). Join whatever group actually owns
|
|
# /workspace too, if it differs.
|
|
WORKSPACE_GID="$(stat -c %g /workspace 2>/dev/null || true)"
|
|
if [ -n "$WORKSPACE_GID" ] && [ "$WORKSPACE_GID" != "$USER_GID" ]; then
|
|
groupadd -g "$WORKSPACE_GID" workspace 2>/dev/null || true
|
|
usermod -aG "$WORKSPACE_GID" builder 2>/dev/null || true
|
|
fi
|
|
|
|
# The Go module cache under /opt/go was populated as root at image-build
|
|
# time (see Dockerfile) - readable by anyone, but go build also wants to
|
|
# write GOCACHE (build cache) under there by default. Point it at a
|
|
# per-run tmpfs-friendly location inside the builder's own home instead of
|
|
# fighting permissions on the image's baked-in GOPATH.
|
|
export GOCACHE=/home/builder/.cache/go-build
|
|
export GOMODCACHE=/opt/go/pkg/mod
|
|
|
|
exec gosu builder "$@"
|