|
| 1 | +package docker |
| 2 | + |
| 3 | +import ( |
| 4 | + "archive/tar" |
| 5 | + "bufio" |
| 6 | + "context" |
| 7 | + "fmt" |
| 8 | + "io" |
| 9 | + "strconv" |
| 10 | + "strings" |
| 11 | + |
| 12 | + "github.com/moby/moby/client" |
| 13 | + "github.com/ryanmoran/contagent/internal/runtime" |
| 14 | +) |
| 15 | + |
| 16 | +// resolveImageUser parses the Docker USER field and resolves it to uid/gid. |
| 17 | +// The USER field format is "[user][:group]" where each part can be a name or numeric ID. |
| 18 | +// If names are present, they are resolved via /etc/passwd and /etc/group copied from |
| 19 | +// the container with the given containerID (which may be stopped). |
| 20 | +func resolveImageUser(ctx context.Context, dockerClient DockerClient, containerID, userStr string) (runtime.ImageUser, error) { |
| 21 | + if userStr == "" { |
| 22 | + return runtime.ImageUser{}, nil |
| 23 | + } |
| 24 | + |
| 25 | + userPart, groupPart, hasGroup := strings.Cut(userStr, ":") |
| 26 | + |
| 27 | + userUID, userIsNumeric := tryParseInt(userPart) |
| 28 | + groupGID, groupIsNumeric := tryParseInt(groupPart) |
| 29 | + |
| 30 | + // Fast path: both parts are numeric (or group is absent with a numeric user) |
| 31 | + if userIsNumeric && (!hasGroup || groupIsNumeric) { |
| 32 | + gid := userUID // default gid = uid when no group specified |
| 33 | + if hasGroup { |
| 34 | + gid = groupGID |
| 35 | + } |
| 36 | + return runtime.ImageUser{UID: userUID, GID: gid}, nil |
| 37 | + } |
| 38 | + |
| 39 | + // Slow path: resolve names via /etc/passwd and /etc/group from the container |
| 40 | + var uid, gid int |
| 41 | + var err error |
| 42 | + |
| 43 | + if userIsNumeric { |
| 44 | + uid = userUID |
| 45 | + gid = userUID // fallback; may be overridden below |
| 46 | + } else { |
| 47 | + uid, gid, err = lookupUser(ctx, dockerClient, containerID, userPart) |
| 48 | + if err != nil { |
| 49 | + return runtime.ImageUser{}, fmt.Errorf("failed to resolve user %q: %w", userPart, err) |
| 50 | + } |
| 51 | + } |
| 52 | + |
| 53 | + if hasGroup { |
| 54 | + if groupIsNumeric { |
| 55 | + gid = groupGID |
| 56 | + } else { |
| 57 | + gid, err = lookupGroup(ctx, dockerClient, containerID, groupPart) |
| 58 | + if err != nil { |
| 59 | + return runtime.ImageUser{}, fmt.Errorf("failed to resolve group %q: %w", groupPart, err) |
| 60 | + } |
| 61 | + } |
| 62 | + } |
| 63 | + |
| 64 | + return runtime.ImageUser{UID: uid, GID: gid}, nil |
| 65 | +} |
| 66 | + |
| 67 | +func tryParseInt(s string) (int, bool) { |
| 68 | + if s == "" { |
| 69 | + return 0, false |
| 70 | + } |
| 71 | + n, err := strconv.Atoi(s) |
| 72 | + return n, err == nil |
| 73 | +} |
| 74 | + |
| 75 | +func copyFileFromContainer(ctx context.Context, dockerClient DockerClient, containerID, srcPath string) (string, error) { |
| 76 | + result, err := dockerClient.CopyFromContainer(ctx, containerID, client.CopyFromContainerOptions{ |
| 77 | + SourcePath: srcPath, |
| 78 | + }) |
| 79 | + if err != nil { |
| 80 | + return "", fmt.Errorf("failed to copy %q from container: %w", srcPath, err) |
| 81 | + } |
| 82 | + defer result.Content.Close() |
| 83 | + |
| 84 | + tr := tar.NewReader(result.Content) |
| 85 | + if _, err = tr.Next(); err != nil { |
| 86 | + return "", fmt.Errorf("failed to read tar entry from container copy: %w", err) |
| 87 | + } |
| 88 | + |
| 89 | + content, err := io.ReadAll(tr) |
| 90 | + if err != nil { |
| 91 | + return "", fmt.Errorf("failed to read file content: %w", err) |
| 92 | + } |
| 93 | + |
| 94 | + return string(content), nil |
| 95 | +} |
| 96 | + |
| 97 | +// lookupUser finds a username in /etc/passwd and returns its uid and primary gid. |
| 98 | +func lookupUser(ctx context.Context, dockerClient DockerClient, containerID, username string) (uid, gid int, err error) { |
| 99 | + content, err := copyFileFromContainer(ctx, dockerClient, containerID, "/etc/passwd") |
| 100 | + if err != nil { |
| 101 | + return 0, 0, err |
| 102 | + } |
| 103 | + |
| 104 | + scanner := bufio.NewScanner(strings.NewReader(content)) |
| 105 | + for scanner.Scan() { |
| 106 | + line := strings.TrimSpace(scanner.Text()) |
| 107 | + if line == "" || strings.HasPrefix(line, "#") { |
| 108 | + continue |
| 109 | + } |
| 110 | + fields := strings.SplitN(line, ":", 7) |
| 111 | + if len(fields) < 4 || fields[0] != username { |
| 112 | + continue |
| 113 | + } |
| 114 | + uid, err = strconv.Atoi(fields[2]) |
| 115 | + if err != nil { |
| 116 | + return 0, 0, fmt.Errorf("invalid uid for user %q in /etc/passwd: %w", username, err) |
| 117 | + } |
| 118 | + gid, err = strconv.Atoi(fields[3]) |
| 119 | + if err != nil { |
| 120 | + return 0, 0, fmt.Errorf("invalid gid for user %q in /etc/passwd: %w", username, err) |
| 121 | + } |
| 122 | + return uid, gid, nil |
| 123 | + } |
| 124 | + return 0, 0, fmt.Errorf("user %q not found in /etc/passwd", username) |
| 125 | +} |
| 126 | + |
| 127 | +// lookupGroup finds a group name in /etc/group and returns its gid. |
| 128 | +func lookupGroup(ctx context.Context, dockerClient DockerClient, containerID, groupName string) (gid int, err error) { |
| 129 | + content, err := copyFileFromContainer(ctx, dockerClient, containerID, "/etc/group") |
| 130 | + if err != nil { |
| 131 | + return 0, err |
| 132 | + } |
| 133 | + |
| 134 | + scanner := bufio.NewScanner(strings.NewReader(content)) |
| 135 | + for scanner.Scan() { |
| 136 | + line := strings.TrimSpace(scanner.Text()) |
| 137 | + if line == "" || strings.HasPrefix(line, "#") { |
| 138 | + continue |
| 139 | + } |
| 140 | + fields := strings.SplitN(line, ":", 4) |
| 141 | + if len(fields) < 3 || fields[0] != groupName { |
| 142 | + continue |
| 143 | + } |
| 144 | + gid, err = strconv.Atoi(fields[2]) |
| 145 | + if err != nil { |
| 146 | + return 0, fmt.Errorf("invalid gid for group %q in /etc/group: %w", groupName, err) |
| 147 | + } |
| 148 | + return gid, nil |
| 149 | + } |
| 150 | + return 0, fmt.Errorf("group %q not found in /etc/group", groupName) |
| 151 | +} |
0 commit comments