Repository navigation
Pin the @osaas/cli version in the entrypoint and run the image as a non-root user #33
Closed as not planned
Description
Part of Eyevinn/osaas-app#7052.
Public repository: keep PR text and comments neutral. Context lives in the private parent.
Directions
scripts/docker-entrypoint.sh(~232): same pinning as web-runner (oneOSAAS_CLI_VERSION, no@latest).- Run the container as a non-root user.
Acceptance criteria
- No
@osaas/cli@latestremains; the version is defined in one place. - Existing tests and the image build pass.
- The image runs as a non-root user and the documented behaviour (pip installs, writes to the app directory) still works. If it cannot, post
## Spec Invalidnaming the behaviour that blocks it and leave this ticket open; the PR for item 1 then usesPart of #<this ticket's number>without a closing keyword.
PR closing keywords
The PR body uses Part of #<this ticket's number> (no closing keyword) while an acceptance criterion is open; the final PR carries Closes #<this ticket's number>. No closing keyword for Eyevinn/osaas-app#7052.
What a human does next
Nothing.
Activity
eyevinn-developer commentedon Nov 3, 2026
Spec Invalid
Acceptance criterion 3 (run as a non-root user with pip installs and app-directory writes still working) could not be established, so the first PR covers item 1 only (version pinning) and uses
Part of #33. This ticket stays open.What could not be verified, and why it matters here:
pip installinto the system Python (pip install --no-cache-dir ...for pyproject, requirements, setup.py and requirements-dev) and the image installsgradiosystem-wide at build time. As a non-root user the system site-packages are not writable, so installs would silently switch to a per-user location, which needs a writable HOME and changes where packages (and their console scripts) land on PATH. That needs a deliberate choice (a venv owned by the runtime user, orPIP_USER/PYTHONUSERBASEplus PATH) and a real run to confirm./usercontentis a declared VOLUME that the entrypoint clears (rm -rf /usercontent/*) and clones into, and it also writes.commit-info.jsonthere. Its ownership at runtime depends on how the platform mounts the volume, which cannot be settled by reading the Dockerfile.Next step: decide the pip install location for the non-root user and verify with a container build and run on a machine with docker (pip install from requirements.txt, clone into
/usercontent, setup.sh, app start on port 8080).birme commentedon Nov 3, 2026
Moved back to Backlog by daily-review (Step 6c): the only merged PR (#34,
Part of #33) covers criterion 1 (pin @osaas/cli). Criterion 3 (run as non-root, needs a decision on where pip installs go) is not done and nothing else owns it; criterion 2 (image build) was not confirmed. Needs re-spec by daily-triage.birme commentedon Nov 4, 2026
Decision (birme, 2026-11-04): the runtime user of the image is not changed at this time.
@osaas/cliversion, defined in one place) shipped in Pin @osaas/cli version in the entrypoint #34.Cause category: product decision.
Prevent next time: none.
Owner of that change: birme.