Skip to content

Commit

Permalink
Remove last root requirements
Browse files Browse the repository at this point in the history
NB! Signing will not pass until manifest schema is valid and SDK
updated. The --disable-manifest-validation flag should be removed from
Dockerfile before merging to release branch
  • Loading branch information
madelen-at-work committed Mar 6, 2024
1 parent 38ca494 commit 3379f76
Show file tree
Hide file tree
Showing 5 changed files with 9 additions and 63 deletions.
3 changes: 2 additions & 1 deletion Dockerfile
Original file line number Diff line number Diff line change
Expand Up @@ -150,7 +150,8 @@ RUN <<EOF
-a slirp4netns \
-a rootlesskit \
-a rootlesskit-docker-proxy \
-a nsenter
-a nsenter \
--disable-manifest-validation
EOF

ENTRYPOINT [ "/opt/axis/acapsdk/sysroots/x86_64-pokysdk-linux/usr/bin/eap-install.sh" ]
13 changes: 7 additions & 6 deletions app/manifest.json
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
{
"schemaVersion": "1.3",
"schemaVersion": "1.8.0",
"resources": {
"linux": {
"user": {
Expand All @@ -22,14 +22,11 @@
"embeddedSdkVersion": "3.0",
"vendorUrl": "https://www.axis.com",
"runMode": "once",
"version": "2.1.0-preview"
"version": "2.0.2-fwsync"
},
"installation": {
"postInstallScript": "postinstallscript.sh"
},
"uninstallation": {
"preUninstallScript": "preuninstallscript.sh"
},
"configuration": {
"paramConfig": [
{
Expand All @@ -53,7 +50,11 @@
"type": "enum:no|No, yes|Yes"
}

]
],
"containers": {
"containerHost": true,
"createDockerSymlinks": true
}
}
}
}
37 changes: 0 additions & 37 deletions app/postinstallscript.sh
Original file line number Diff line number Diff line change
@@ -1,42 +1,5 @@
#!/bin/sh -e

if [ "$(id -un)" != "root" ]; then
logger -p user.warn "$0: Must be run as 'root' instead of user '$(id -un)'."
exit 77 # EX_NOPERM
fi

# Get name and uid of acap user and group
_appname=dockerdwrapperwithcompose
_appdirectory=/usr/local/packages/$_appname
_uname="$(stat -c '%U' "$_appdirectory")"
_uid="$(id "$_uname" -u)" # user id
_gid="$(id "$_uname" -g)" # user group id
_gname="$(id "$_uname" -gn)" # user group name
_all_gids="$(id "$_uname" -G)" # user sub-group ids


# Create mapping for subuid and subgid - both shall use user id as first value!
echo "$_uid:100000:65536" >> /etc/subuid
for sub_group_id in $_all_gids ; do
if [ "$sub_group_id" -ne "$_gid" ]; then
echo "$_uid:$sub_group_id:1" >> /etc/subgid
fi
done
echo "$_uid:100000:65536" >> /etc/subgid

# Update the app service file to work for our special case
cat >> /etc/systemd/system/sdkdockerdwrapperwithcompose.service << EOF
[Unit]
BindsTo=containerd.service
After=network-online.target containerd.service var-spool-storage-SD_DISK.mount
Wants=network-online.target
After=user@$_uid.service
Requires=user@$_uid.service
EOF

# reload daemon for service file changes to take effect
systemctl daemon-reload

# *** non-root user should be able to do this ****

# Move the daemon.json file into localdata folder
Expand Down
19 changes: 0 additions & 19 deletions app/preuninstallscript.sh

This file was deleted.

Binary file removed binaries/systemd-user-runtime-dir
Binary file not shown.

0 comments on commit 3379f76

Please sign in to comment.