Subject: [Tools-discuss] Docker image pulls in home directory

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Jul 2018 05:54:08 -0700

Hi folks,

I see that the docker/run script pulls in one's home directory as the
image's home directory. e.g.,

	docker run -ti -p $PORT:8000 -v "$HOME:/home/$WHO"
          \
	    -e USER="$WHO" -e DATADIR="${parent#$HOME/}/data" -e CWD="${PWD#$HOME/}"	\
	    -e TAG="$TAG" -e FILEDIR=${FILEDIR#$HOME} -e UID="$WHOUID" -e
GID="$WHOGID"	\
	    "$REPO:$TAG" "$@"

I noticed this because my .bashrc contains mac-only commands which don't
execute properly.

In general, I'd prefer only to pull in a very limited set of files
(essentially the datatracker source itself), because I don't want
datatracker to have access to my home directory [0] but I don't see an
argument to suppress this behavior. Would people object to a patch that
mapped in just the source into some subdirectory (potentially as an option)

Thanks,
-Ekr

[0] I recognize that docker doesn't provide complete isolation, but this is
about incompetence (mine), not malice.

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 26 Jul 2018 15:19:28 +0200

> mapped in just the source into some subdirectory (potentially as an option)

As an option, sure.  As the default, no.  There were reasons to do it this
way, and it took a lot of work to get everything in place (and adapted to
different versions of docker) so I'd rather not mess with the default.

Make sure to test your patch both under linux and mac.

	Henrik

> ___________________________________________________________
> Tools-discuss mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/tools-discuss
>
> Please report datatracker.ietf.org and mailarchive.ietf.org
> bugs at http://tools.ietf.org/tools/ietfdb
> or send email to [email-masked]
>
> Please report tools.ietf.org bugs at
> http://tools.ietf.org/tools/issues
> or send email to [email-masked]
>

---

From: Eric Rescorla <[email-masked]>
Date: Thu, 26 Jul 2018 06:21:01 -0700

> different versions of docker) so I'd rather not mess with the default.

Sure, no problem.

Willdo.

-Ekr

---

From: Antony Stone <[email-masked]>
Date: Thu, 26 Jul 2018 15:23:37 +0200

On Thursday 26 July 2018 at 15:19:28, Henrik Levkowetz wrote:

> As an option, sure.  As the default, no.

This seems a bit ambiguous to me - are you (Henrik) saying that "yes, you 
object to the patch as an option", or "yes, the patch as an option would be 
fine"?

> There were reasons to do it this way, and it took a lot of work to get
> everything in place (and adapted to different versions of docker) so I'd
> rather not mess with the default.
> 
> > [0] I recognize that docker doesn't provide complete isolation, but this
> > is about incompetence (mine), not malice.

Regards,

-- 
Antony Stone
Systems admin
IETF Tools servers
https://www.linkedin.com/in/antonystone

---

From: Henrik Levkowetz <[email-masked]>
Date: Thu, 26 Jul 2018 15:27:03 +0200

> object to the patch as an option", or "yes, the patch as an option would be

The latter :-)