OXYGENHUB

Make the build image readable by any job user 22007df200f3

A job runs as its workspace's owner on the runner host, which differs
between runners: 1001 on Earth, 997 on plex. The vendored crates kept
Earth's 0640 umask, so plex's dist job could not read them. build.sh
opens the build inputs to all before docker build, and the image opens
/opt at the end.

refs andymccall/oxygen#59
Author
Andy McCall @andymccall <[email protected]>
When
· 2026-10-02 22:52 UTC
Signature
✔ signed by Andy McCall
Hash
22007df200f30dd8e9c66979c132785fda99bbe3223cdaa8caec651d9bd54617
Depends on
eb5c4db673e5 eba589f87e4f
Depended on by
f3b5b86e23ef
In bookmarks
main newer-pipeline push-uses-login
In tags
v0.2.0 v0.3.0 v0.3.1 v0.4.0 v0.5.0 v0.5.1 v0.5.2 v0.5.3
Edits
2 atoms, 0 tree operations, 2 files

Browse the tree at this change

hide whitespace changes
modified images/rust/Dockerfile +4 −0
… 
47 unchanged lines
48 48 
        mkdir -p /opt/warm; mv /src/target "/opt/warm/$name"; cd /; \
49 49 
    done; \
50 50 
    rm -rf /src /tmp/warm /root/.cargo/registry /root/.cargo/git; mkdir /src
51 + 

    

  
    

      
      52
      +
      
# Everything under /opt readable and its directories searchable by any

    

  
    

      
      53
      +
      
# user: jobs do not run as root, and their uid is the runner host's.

    

  
    

      
      54
      +
      
RUN chmod -R a+rX /opt

    

  
  

  





  
    modified
    images/rust/build.sh
    +4 −0
  
  
  

  
    

      
      
      …
      
30 unchanged lines

    

  
    

      31
      31
       
      
for ws in oxygenhub; do

    

  
    

      32
      32
       
      
    python3 "$here/recipe.py" "$dev/$ws" "$here/warm/$ws"

    

  
    

      33
      33
       
      
done

    

  
    

      
      34
      +
      
# Readable by any user: a job runs as its workspace's owner on the runner

    

  
    

      
      35
      +
      
# host, which differs between runners (oxygen#59: 0640 files from Earth's

    

  
    

      
      36
      +
      
# umask failed plex's dist job).

    

  
    

      
      37
      +
      
chmod -R a+rX "$here/vendor" "$here/npm-cache" "$here/warm"

    

  
    

      34
      38
       
      
docker build -q -t oxygenflow-build \

    

  
    

      35
      39
       
      
    --build-arg NODE_VERSION=$NODE_VERSION --build-arg NODE_SHA256=$NODE_SHA256 "$here"

    

  
    

      36
      40
       
      
id=$(docker create oxygenflow-build)

    

  
    

      
      
      …
      
4 unchanged lines