From 4819bf07b492531a63751d0af538a73b698a7332 Mon Sep 17 00:00:00 2001 From: rldyourmnd Date: Tue, 1 Sep 2026 03:21:54 +0500 Subject: [PATCH] fix(image): probe bwrap after the runner user exists The b20 build died on my own ordering: the provisioning probe ran runuser -u runner before the block that creates the runner user. The probe moves to just after user creation, where the profile is already loaded and the user it authenticates as is real. Recipe fingerprint golden follows. Claude-Session: https://claude.ai/code/session_01LsGid6U5RrQdFvJmvYdGCF --- internal/imagebuild/assets/provision.sh | 18 +++++++++--------- internal/imagebuild/orchestrator_test.go | 2 +- 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/internal/imagebuild/assets/provision.sh b/internal/imagebuild/assets/provision.sh index b122f4d..c5e5078 100644 --- a/internal/imagebuild/assets/provision.sh +++ b/internal/imagebuild/assets/provision.sh @@ -44,6 +44,15 @@ ln -sfn /usr/bin/pip3 /usr/local/bin/pip3 python --version >/dev/null pip --version >/dev/null +systemctl disable --now apt-daily.timer apt-daily-upgrade.timer unattended-upgrades.service 2>/dev/null || true +git lfs install --system +groupadd --force docker +groupadd --force lxd + +if ! id runner >/dev/null 2>&1; then + useradd --create-home --home-dir /home/runner --shell /bin/bash --groups sudo runner +fi + # bubblewrap is on the image for consumers that need a network isolator, but # a binary on disk is not a capability: Ubuntu 24.04 ships # kernel.apparmor_restrict_unprivileged_userns=1, and without an AppArmor @@ -61,15 +70,6 @@ APPARMOR chmod 0644 /etc/apparmor.d/bwrap-userns apparmor_parser --replace /etc/apparmor.d/bwrap-userns runuser -u runner -- env HOME=/home/runner bwrap --ro-bind / / true - -systemctl disable --now apt-daily.timer apt-daily-upgrade.timer unattended-upgrades.service 2>/dev/null || true -git lfs install --system -groupadd --force docker -groupadd --force lxd - -if ! id runner >/dev/null 2>&1; then - useradd --create-home --home-dir /home/runner --shell /bin/bash --groups sudo runner -fi install -d -o root -g root -m 0750 /etc/sudoers.d printf 'runner ALL=(ALL) NOPASSWD:ALL\n' >/etc/sudoers.d/90-nddev-runner chmod 0440 /etc/sudoers.d/90-nddev-runner diff --git a/internal/imagebuild/orchestrator_test.go b/internal/imagebuild/orchestrator_test.go index ede8f26..37b6d23 100644 --- a/internal/imagebuild/orchestrator_test.go +++ b/internal/imagebuild/orchestrator_test.go @@ -164,7 +164,7 @@ func TestRecipeFingerprintIsDeterministic(t *testing.T) { // alias is part of the recipe, so a manifest whose contents changed under an // unchanged alias would otherwise ask the builder to produce different bytes // for a name that is already promoted. - if first != "sha256:835c7ed10be62b3ac1cca36572c08b8661b0df5451f1b594bbb4ce7cf19f9ebf" { + if first != "sha256:4cc00e2ee72d7ed4646f84229f3b6a2d5c6d4aeeb05aae29f15f4e1bd381eeb1" { t.Fatalf("deployed standard recipe fingerprint drifted: %q", first) } smoke, err := SmokeFingerprint(plan)