[Bug][gitextractor] Dockerfile - devlake user cannot run update-ca-certificates

[clement-igonet]

Search before asking

• I had searched in the issues and found no similar issues.

What happened

The Configuration Troubleshooting page here indicates to make run update-ca-certificates to import rootCA.
However, it is not possible as a devlake (non root) user (at least on v0.18.0 and above)

See backend/Dockerfile:

RUN useradd -ms /bin/bash -d /app devlake -u 1010
USER devlake

What do you expect to happen

I expect update-ca-certificates to be runnable.

How to reproduce

Follow the documentation:

  devlake:
    image: apache/devlake:v...
    ...
    volumes:
      ...
      - /path/to/your/rootCA.crt:/usr/local/share/ca-certificates/rootCA.crt
    command: [ "sh", "-c", "update-ca-certificates; lake" ]
    ...

Anything else

No response

Version

v0.18.0 and above

Are you willing to submit PR?

• Yes I am willing to submit a PR!

Code of Conduct

• I agree to follow this project's Code of Conduct

[klesh]

@clement-igonet You are right, this is problematic, thanks for reporting the issue.
@ZhangNing10 please take a look

[ZhangNing10]

@clement-igonet you can try below solution:
mkdir certs
chown -R 1010:1010
then in the docker-compose.yml, mount ./certs to /etc/ssl/certs

[klesh]

Nice work, @ZhangNing10 Please update the doc as well, thanks

[clement-igonet]

This workaround give good results:

mkdir certs
chown -R 1010:1010

A lot of thanks !

However, for such chmod operation, it forces the user to be able to use root priviledges in the host machine...
Is it better than keeping a root user inside the container ?
Knowing also that in the environment I develop with (shared Debian machine, 1010 uid is already used by another user in the host machine)

Maybe a more acceptable workaround would be to create a dedicated docker volume to manage certs with the expected uid:gid
Example here: https://pratikpc.medium.com/use-docker-compose-named-volumes-as-non-root-within-your-containers-1911eb30f731