build protoc-* containers as nonroot

[bobcallaway]

Fixes: #251

This switches the base image for protoc-base from alpine to debian because alpine doesn't support the full range of UID/GID values that debian does.

this allows you to make clean && make all without sudo :)

[cpanato]

nice

[woodruffw]

Awesome, thanks @bobcallaway!

[kommendorkapten]

Running into some issues on mac:

 => ERROR [protoc-builder 4/9] RUN addgroup --gid 20 myuser && adduser --  0.4s
------
 > [protoc-builder 4/9] RUN addgroup --gid 20 myuser && adduser --uid 501 --ingroup myuser --disabled-password myuser:
#11 0.415 addgroup: The GID `20' is already in use.
------
executor failed running [/bin/sh -c addgroup --gid ${GID} myuser && adduser --uid ${UID} --ingroup myuser --disabled-password myuser]: exit code: 1
make: *** [docker-image] Error 1

I'll debug and see what issue I'm facing.

[kommendorkapten]

When I worked on this in #251 I never bothered to set the group in the Dockerfile, but passed the group id via the run command. Reverting the group stuff locally works.

I can push the change if you want, but this is what I did:

diff --git a/Makefile b/Makefile
index 093e86a..e5e67f3 100644
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,7 @@ RUST_ACTION ?= run -p sigstore-protobuf-specs-codegen
 PLATFORM ?= linux/amd64
 UID ?= $(shell id -u)
 GID ?= $(shell id -g)
-DOCKER_BUILD = docker build --platform ${PLATFORM} --build-arg UID=${UID} --build-arg GID=${GID}
+DOCKER_BUILD = docker build --platform ${PLATFORM} --build-arg UID=${UID}
 DOCKER_RUN = docker run --platform ${PLATFORM} --user ${UID}:${GID}

 PROTOS = $(shell find protos/ -iname "*.proto" | sed 's|^|/defs/|')
diff --git a/protoc-builder/Dockerfile.protoc b/protoc-builder/Dockerfile.protoc
index 3595cc4..9ab3f87 100644
--- a/protoc-builder/Dockerfile.protoc
+++ b/protoc-builder/Dockerfile.protoc
@@ -11,12 +11,11 @@ RUN apt-get update && apt-get install -y unzip git

 # Set up user and group to match host we're building the container on
 ARG UID
-ARG GID

-RUN addgroup --gid ${GID} myuser && adduser --uid ${UID} --ingroup myuser --disabled-password myuser
+RUN adduser --uid ${UID} --disabled-password myuser

 # Set permissions on the output directories so the user can write to them
-RUN chown myuser:myuser /protobuf /googleapis
+RUN chown myuser /protobuf /googleapis

 # Switch to user to execute the remaining commands
 USER myuser

[bobcallaway]

When I worked on this in #251 I never bothered to set the group in the Dockerfile, but passed the group id via the run command. Reverting the group stuff locally works.

I can push the change if you want, but this is what I did:

diff --git a/Makefile b/Makefile
index 093e86a..e5e67f3 100644
--- a/Makefile
+++ b/Makefile
@@ -26,7 +26,7 @@ RUST_ACTION ?= run -p sigstore-protobuf-specs-codegen
 PLATFORM ?= linux/amd64
 UID ?= $(shell id -u)
 GID ?= $(shell id -g)
-DOCKER_BUILD = docker build --platform ${PLATFORM} --build-arg UID=${UID} --build-arg GID=${GID}
+DOCKER_BUILD = docker build --platform ${PLATFORM} --build-arg UID=${UID}
 DOCKER_RUN = docker run --platform ${PLATFORM} --user ${UID}:${GID}

 PROTOS = $(shell find protos/ -iname "*.proto" | sed 's|^|/defs/|')
diff --git a/protoc-builder/Dockerfile.protoc b/protoc-builder/Dockerfile.protoc
index 3595cc4..9ab3f87 100644
--- a/protoc-builder/Dockerfile.protoc
+++ b/protoc-builder/Dockerfile.protoc
@@ -11,12 +11,11 @@ RUN apt-get update && apt-get install -y unzip git

 # Set up user and group to match host we're building the container on
 ARG UID
-ARG GID

-RUN addgroup --gid ${GID} myuser && adduser --uid ${UID} --ingroup myuser --disabled-password myuser
+RUN adduser --uid ${UID} --disabled-password myuser

 # Set permissions on the output directories so the user can write to them
-RUN chown myuser:myuser /protobuf /googleapis
+RUN chown myuser /protobuf /googleapis

 # Switch to user to execute the remaining commands
 USER myuser

ack, applied changes and this runs clean on my linux box too

[kommendorkapten]

Tested on macOS, works as expected. Nice job 👏