fix(agent/agentcontainers): chown coder binary #18611
Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR adds a chown step to ensure the coder binary inside the container is owned by the container user, and updates tests to expect this new step.
- Inject a
chownExecAs call inmaybeInjectSubAgentIntoContainerLockedto set binary ownership. - Add matching mocked
ExecAs(... chown ...)expectations in multiple tests.
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
| agent/agentcontainers/api.go | Insert a shell-based chown call to set ownership on the agent binary |
| agent/agentcontainers/api_test.go | Add mocked ExecAs expectations for the chown call in tests |
Comments suppressed due to low confidence (1)
agent/agentcontainers/api.go:1445
- [nitpick] The comment mentions ensuring the binary is executable, but this block actually changes ownership via chown. Consider updating the comment to reflect setting ownership (e.g., "Ensure the agent binary is owned by the container user").
// Make sure the agent binary is executable so we can run it.
Co-authored-by: Copilot <[email protected]>
| // Make sure the agent binary is executable so we can run it. | ||
| if _, err := api.ccli.ExecAs(ctx, container.ID, "root", "/bin/sh", "-c", fmt.Sprintf("chown $(id -u):$(id -g) %s", coderPathInsideContainer)); err != nil { | ||
| return xerrors.Errorf("set agent binary ownership: %w", err) | ||
| } |
There was a problem hiding this comment.
Do we need to chown the folder as well or not?
There was a problem hiding this comment.
I don't think so.
| @@ -1442,6 +1442,11 @@ func (api *API) maybeInjectSubAgentIntoContainerLocked(ctx context.Context, dc c | |||
| return xerrors.Errorf("set agent binary executable: %w", err) | |||
| } | |||
|
|
|||
| // Make sure the agent binary is executable so we can run it. | |||
There was a problem hiding this comment.
| // Make sure the agent binary is executable so we can run it. | |
| // Make sure the agent binary is owned by a valid user so we can run it. |
Perhaps?
There was a problem hiding this comment.
Oops, just hit the green button as you replied 🤦♀️ Second time I've done this 😅
There was a problem hiding this comment.
I've got another PR up so I'll add add the change to that PR, I need to be a little less quick on merging
No description provided.