[Solved]How to use makepkg to install dependencies inside docker image

TheFiddler · 2017-08-11 18:56:45

I am trying to run makepkg in a Dockerfile in order to make architecture-optimized packages. Since makepkg cannot be run as root, I create a normal user profile first:

RUN useradd --no-create-home --shell=/bin/false build && usermod -L build
USER build
RUN git clone https://aur.archlinux.org/python.git && cd python && makepkg -s python
USER root
RUN pacman -U *.pkg.tar.xz

However here I am stuck: "makepkg -s" fails because user "build" does not have root permission. At the same time, running makepkg as root is not allowed.

Is there a way to automatically download dependencies and build a package without listing each and every dependency by hand?

Last edited by TheFiddler (2017-08-12 00:29:56)

eschwartz · 2017-08-11 21:11:28

The user root should be given root permission, e.g. via sudo.

Alternatively, you can do the following as root:

source PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"

Last edited by eschwartz (2017-08-11 21:12:38)

TheFiddler · 2017-08-12 00:29:26

Thanks, I resolved this by giving root permissions to user "build":

RUN useradd --no-create-home --shell=/bin/false build && usermod -L build
RUN echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
RUN echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

To be honest, I'm not sure I understand what is the difference between running makepkg as root (which is disallowed) compared to a different user with root permissions (which can cause the same amount of damage given a malicious package). In any case, this solution works and allows me to build a docker image with the packages I need.

Thanks!

Lone_Wolf · 2017-08-12 17:22:00

makepkg only needs/uses root rights when it runs pacman ( installing / removing dependencies , installing the build package ) .

But if you give users sudo access to all commands without needing a password (even if it's only for a few seconds) ,
you might as well put up a big sign welcoming everything malicious.

TheFiddler · 2017-08-12 20:45:23

This is in the context of creating a docker image: the "build" user exists inside the container (not on the host) and only for the duration of the setup (it is removed afterwards).

By default, docker images are build by the root user (again, running *inside* the container, not on the host). Since makepkg refuses to install dependencies when run as root, this workaround of creating a second user with full root permissions is required. If there is a better way to construct a docker image without this complicated dance I'd love to hear it.

Last edited by TheFiddler (2017-08-12 20:46:08)

Slithery · 2017-08-13 00:35:19

Personally I wouldn't build the package on the target image as that means installing base-devel, I'd build the package elsewhere and put it in a custom repo (or just transfer the file) so it can be installed with pacman like everything else

eschwartz · 2017-08-13 04:42:52

TheFiddler wrote:

Thanks, I resolved this by giving root permissions to user "build":
RUN useradd --no-create-home --shell=/bin/false build && usermod -L build
RUN echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
RUN echo "root ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
To be honest, I'm not sure I understand what is the difference between running makepkg as root (which is disallowed) compared to a different user with root permissions (which can cause the same amount of damage given a malicious package). In any case, this solution works and allows me to build a docker image with the packages I need.
Thanks!

1) Typically, you do NOT have NOPASSWD access.
makechrootpkg (from devtools) does add the /etc/sudoers.d/builduser-pacman snippet `builduser ALL = NOPASSWD: /usr/bin/pacman` which only allows pacman access, drastically limiting the damage a malicious package can do.

2) The danger is less malicious packages (people shouldn't be using packages that are that noticeably malicious) and more rogue upstreams that are trying to be "helpful" or simply have badly-written build systems, which try to write to / for whatever ill-defined reason.

sproberts92 · 2017-10-22 15:38:56

Alternatively, you can do the following as root:
source PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"

Be careful using -Syu for this. Any other packages that get updated from the u option will get flagged as deps also, even the kernel. Then you end up with the kernel being listed as orphaned with pacman -Qdt. Better to just use -Sy.

(For anyone in that state, reinstall with --asexplicit to fix).

Last edited by sproberts92 (2017-10-22 15:40:48)

eschwartz · 2017-10-22 23:03:33

sproberts92 wrote:

Alternatively, you can do the following as root:
source PKGBUILD && pacman -Syu --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"
Be careful using -Syu for this. Any other packages that get updated from the u option will get flagged as deps also, even the kernel. Then you end up with the kernel being listed as orphaned with pacman -Qdt. Better to just use -Sy.
(For anyone in that state, reinstall with --asexplicit to fix).

I am absolutely terrified that a temporary docker or systemd-nspawn container will end up with an orphaned kernel package. /s

But point taken. Use

source PKGBUILD && pacman -Syu --noconfirm && pacman -S --noconfirm --needed --asdeps "${makedepends[@]}" "${depends[@]}"

and don't consider using something as horrible as -Sy given that partial updates are even more silly inside a build container than they are inside a badly-managed user install.

...

I somehow feel like pacman shouldn't do this, --asdeps should apply only to the explicitly-listed part of the transaction.

sproberts92 · 2017-10-22 23:19:18

Oops my bad on the y.

Yeah fair enough - in a Docker container it's not a big deal, but if someone tries it outside then trouble can be had.

Eschwartz wrote:

I somehow feel like pacman shouldn't do this, --asdeps should apply only to the explicitly-listed part of the transaction.

I definitely agree this would be better behaviour, it's what I would naturally expect too.

Arch Linux

#1 2017-08-11 18:56:45

[Solved]How to use makepkg to install dependencies inside docker image

#2 2017-08-11 21:11:28

Re: [Solved]How to use makepkg to install dependencies inside docker image

#3 2017-08-12 00:29:26

Re: [Solved]How to use makepkg to install dependencies inside docker image

#4 2017-08-12 17:22:00

Re: [Solved]How to use makepkg to install dependencies inside docker image

#5 2017-08-12 20:45:23

Re: [Solved]How to use makepkg to install dependencies inside docker image

#6 2017-08-13 00:35:19

Re: [Solved]How to use makepkg to install dependencies inside docker image

#7 2017-08-13 04:42:52

Re: [Solved]How to use makepkg to install dependencies inside docker image

#8 2017-10-22 15:38:56

Re: [Solved]How to use makepkg to install dependencies inside docker image

#9 2017-10-22 23:03:33

Re: [Solved]How to use makepkg to install dependencies inside docker image

#10 2017-10-22 23:19:18

Re: [Solved]How to use makepkg to install dependencies inside docker image

Board footer