From 0add50d2c17401c2eb442a9a406c842de188ed8c Mon Sep 17 00:00:00 2001 From: Lars Erik Wik Date: Wed, 12 Aug 2026 14:37:46 +0200 Subject: [PATCH] Now hands the container's output back to the user who started it The script already chowns those mounts to builder on the way in. Now it chowns them back on the way out from a trap. Signed-off-by: Lars Erik Wik --- build-in-container-inner.sh | 5 +++++ build-in-container.py | 8 ++++++++ 2 files changed, 13 insertions(+) diff --git a/build-in-container-inner.sh b/build-in-container-inner.sh index af39b0618..77e802705 100755 --- a/build-in-container-inner.sh +++ b/build-in-container-inner.sh @@ -14,6 +14,11 @@ mkdir -p "$BASEDIR" # Fix ownership so builder can write to them. sudo chown -R "$(id -u):$(id -g)" "$HOME/.cache" /output +# And hand ownership back to the host user on the way out. +if [ -n "$HOST_UID" ] && [ -n "$HOST_GID" ]; then + trap 'sudo chown -R "$HOST_UID:$HOST_GID" "$HOME/.cache" /output' EXIT +fi + # Prevent git "dubious ownership" errors git config --global --add safe.directory '*' diff --git a/build-in-container.py b/build-in-container.py index 372b19385..2bd073a08 100755 --- a/build-in-container.py +++ b/build-in-container.py @@ -11,6 +11,7 @@ import hashlib import json import logging +import os import subprocess import sys import urllib.request @@ -387,6 +388,13 @@ def run_container(args, image_tag, source_dir, script_dir): f"EXPLICIT_ROLE={args.role}", "-e", f"BUILD_NUMBER={args.build_number}", + # Who to give the writable mounts back to. The container builds as + # its own user, whose UID is not ours, so without this the packages + # and the cache come out owned by a stranger. + "-e", + f"HOST_UID={os.getuid()}", + "-e", + f"HOST_GID={os.getgid()}", "-e", f"JOB_BASE_NAME={cache_label}", "-e",