-
Notifications
You must be signed in to change notification settings - Fork 791
[SYCL][Devops] Fix containers build #16324
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
[SYCL][Devops] Fix containers build #16324
Conversation
We already have `sycl` user created by a base image, no need to repeat that. This is a follow-up to intel#16290 to address an issue which was not caught by pre-commit.
Any ideas how to fix that? Doubt that it is caused by the change |
did we change anything about permissions or groups? sorry i forget |
Well, technically we do switch into I'm not entirely sure which exact user is doing |
i think it used be running as |
🙏 |
uuh |
Perhaps I need to move |
@AlexeySachkov I think we need this in the I tried to do the same thing before but it kinda got push back but if it was running as root before i would argue its actually slightly better with the above change |
It seems to me that the main point of push back was |
oh yeah my bad |
Considering that we have reverted the original commit, I will close this for now in favor of a new PR which will be a complete re-submit of the whole refactoring. |
…16411) This is a re-submit of #16290 with fixes from #16324 and some more extra changes. Issues addressed: - AVD-DS-0017 (HIGH): The instruction 'RUN <package-manager> update' should always be followed by '<package-manager> install' in the same RUN statement. See https://avd.aquasec.com/misconfig/ds017 - AVD-DS-0002 (HIGH): Specify at least 1 USER command in Dockerfile with non-root user as argument See https://avd.aquasec.com/misconfig/ds002 - AVD-DS-0002 (HIGH): Last USER command in Dockerfile should not be 'root' Issues remaining: - AVD-DS-0026 (LOW): Add HEALTHCHECK instruction in your Dockerfile See https://avd.aquasec.com/misconfig/ds026 I didn't add `HEALTHCHECK` command to our containers, because I don't know if that makes sense and which command to launch. I.e. our containers they only provide some pre-installed tools, but they don't launch any services which we could check. User creation was outlined into a separate helper script. Our containers only come with `sycl_ci` user now which requires a password to use `sudo`. However, it is still possible to get the original `sycl` user for those who uses that container locally and needs `sudo` access.
We already have
sycl
user created by a base image, no need to repeat that.This is a follow-up to #16290 to address an issue which was not caught by pre-commit.