* Determines whether the sandbox container should be run with the current user's UID and GID. * This is often necessary on Linux systems (especially Debian/Ubuntu based) when using * rootful Docker without userns-remap configured, to avoid permission issues with * mounted volumes. * * The behav
()
| 64 | * @returns {Promise<boolean>} A promise that resolves to true if the current user's UID/GID should be used, false otherwise. |
| 65 | */ |
| 66 | async function shouldUseCurrentUserInSandbox(): Promise<boolean> { |
| 67 | const envVar = process.env['SANDBOX_SET_UID_GID']?.toLowerCase().trim(); |
| 68 | |
| 69 | if (envVar === '1' || envVar === 'true') { |
| 70 | return true; |
| 71 | } |
| 72 | if (envVar === '0' || envVar === 'false') { |
| 73 | return false; |
| 74 | } |
| 75 | |
| 76 | // If environment variable is not explicitly set, check for Debian/Ubuntu Linux |
| 77 | if (os.platform() === 'linux') { |
| 78 | try { |
| 79 | const osReleaseContent = await readFile('/etc/os-release', 'utf8'); |
| 80 | if ( |
| 81 | osReleaseContent.includes('ID=debian') || |
| 82 | osReleaseContent.includes('ID=ubuntu') || |
| 83 | osReleaseContent.match(/^ID_LIKE=.*debian.*/m) || // Covers derivatives |
| 84 | osReleaseContent.match(/^ID_LIKE=.*ubuntu.*/m) // Covers derivatives |
| 85 | ) { |
| 86 | // note here and below we use console.error for informational messages on stderr |
| 87 | console.error( |
| 88 | 'INFO: Defaulting to use current user UID/GID for Debian/Ubuntu-based Linux.', |
| 89 | ); |
| 90 | return true; |
| 91 | } |
| 92 | } catch (_err) { |
| 93 | // Silently ignore if /etc/os-release is not found or unreadable. |
| 94 | // The default (false) will be applied in this case. |
| 95 | console.warn( |
| 96 | 'Warning: Could not read /etc/os-release to auto-detect Debian/Ubuntu for UID/GID default.', |
| 97 | ); |
| 98 | } |
| 99 | } |
| 100 | return false; // Default to false if no other condition is met |
| 101 | } |
| 102 | |
| 103 | // docker does not allow container names to contain ':' or '/', so we |
| 104 | // parse those out to shorten the name |