Repository navigation
fix(proto): keep runtime caches writable for host users - #871
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Proto 0.0.22 fails generation on Linux when the companion runs as the host user: root build checks left
/tmp/.cacheowned by root, so Buf exits withmkdir /tmp/.cache/buf: permission denied. Reproduced with the published image under UID 1001; macOS generation ran as root and missed it.Fix at the owner: keep installation caches in the build user's home, set the writable runtime home only after installation, and run architecture/tool/cache smoke checks as UID 65532 on a temporary mount. Build checks cannot leave caches in the final image. The default runtime user is unchanged; Codefly still selects the host UID. This reuses Docker/BuildKit's existing temporary mount and the existing companion qualification suite.
Adds a real-container regression test running Buf, Swagger and npm cache access as UID 1001. It fails on published 0.0.22 with the exact hosted error. Bumps proto to 0.0.23 and Core to 0.19.15; existing tags remain immutable. Documentation: companions/proto/README.md explains cache ownership and the new release; docs/runbooks/bump-protobuf-es.md keeps its source citation current.
Validation: regression demonstrated red on published 0.0.22; removing only the owned caches in a disposable container makes real Buf compilation, Swagger and npm cache access pass as non-root. Focused companions/ciguard/version tests passed with exit 0. All six multiarchitecture image builds passed; proto amd64 and arm64 both executed the non-root Buf compilation, Swagger, npm-cache and architecture checks successfully (run40777808406). Full Core coverage/race gate is still running. Full published-image tagged suite and CLI Docker generation checks must pass before CLI PR codefly-dev/cli#1219 merges. Agent wire contract unchanged. No NYL clearance claim.