container: Allow disabling the overwrite of /etc files

Whilst certainly handy for boulder, this is breaking our
moss invocations of triggers, and prevents a read-only
mount of /etc.

With this change, we fix the behaviour for moss itself,
and retain the old behaviour for boulder.

Signed-off-by: Ikey Doherty <[email protected]>

Author: ikeycode

crates/container/src/lib.rs

@@ -30,9 +30,11 @@ pub struct Container {
     networking: bool,
     hostname: Option<String>,
     ignore_host_sigint: bool,
+    override_accounts: bool,
 }
 
 impl Container {
+    /// Create a new Contaienr using the default options
     pub fn new(root: impl Into<PathBuf>) -> Self {
         Self {
             root: root.into(),
@@ -41,16 +43,19 @@ impl Container {
             networking: false,
             hostname: None,
             ignore_host_sigint: false,
+            override_accounts: true,
         }
     }
 
+    /// Override the working directory
     pub fn work_dir(self, work_dir: impl Into<PathBuf>) -> Self {
         Self {
             work_dir: Some(work_dir.into()),
             ..self
         }
     }
 
+    /// Create a read-write bind mount
     pub fn bind_rw(mut self, host: impl Into<PathBuf>, guest: impl Into<PathBuf>) -> Self {
         self.binds.push(Bind {
             source: host.into(),
@@ -60,6 +65,7 @@ impl Container {
         self
     }
 
+    /// Create a read-only bind mount
     pub fn bind_ro(mut self, host: impl Into<PathBuf>, guest: impl Into<PathBuf>) -> Self {
         self.binds.push(Bind {
             source: host.into(),
@@ -69,20 +75,30 @@ impl Container {
         self
     }
 
+    /// Configure networking availability
     pub fn networking(self, enabled: bool) -> Self {
         Self {
             networking: enabled,
             ..self
         }
     }
 
+    /// Override hostname (via /etc/hostname)
     pub fn hostname(self, hostname: impl ToString) -> Self {
         Self {
             hostname: Some(hostname.to_string()),
             ..self
         }
     }
 
+    /// Override the system accounts (`/etc/{passwd,group}`) for builders
+    pub fn override_accounts(self, configure: bool) -> Self {
+        Self {
+            override_accounts: configure,
+            ..self
+        }
+    }
+
     /// Ignore `SIGINT` from the parent process. This allows it to be forwarded to a
     /// spawned process inside the container by using [`forward_sigint`].
     pub fn ignore_host_sigint(self, ignore: bool) -> Self {
@@ -92,6 +108,7 @@ impl Container {
         }
     }
 
+    /// Run `f` as a container process payload
     pub fn run<E>(self, mut f: impl FnMut() -> Result<(), E>) -> Result<(), Error>
     where
         E: std::error::Error + 'static,
@@ -192,6 +209,7 @@ impl Container {
     }
 }
 
+/// Reenter the container
 fn enter<E>(
     container: &Container,
     sync: (i32, i32),
@@ -216,14 +234,17 @@ where
     f().map_err(|e| ContainerError::Run(Box::new(e)))
 }
 
+/// Setup the container
 fn setup(container: &Container) -> Result<(), ContainerError> {
     if container.networking {
         setup_networking(&container.root)?;
     }
 
     pivot(&container.root, &container.binds)?;
 
-    setup_root_user()?;
+    if container.override_accounts {
+        setup_root_user()?;
+    }
 
     if let Some(hostname) = &container.hostname {
         sethostname(hostname)?;
@@ -236,6 +257,7 @@ fn setup(container: &Container) -> Result<(), ContainerError> {
     Ok(())
 }
 
+/// Pivot the process into the rootfs
 fn pivot(root: &Path, binds: &[Bind]) -> Result<(), ContainerError> {
     const OLD_PATH: &str = "old_root";
 

crates/moss/src/client/postblit.rs

@@ -19,7 +19,7 @@ use triggers::{
     TriggerCommand,
 };
 
-use crate::{environment, Installation};
+use crate::Installation;
 
 use super::{create_root_links, PendingFile};
 
@@ -77,11 +77,10 @@ pub(crate) async fn handle_postblits(
 /// `staging_dir` for the `/usr` tree, and execution is performed within a clone-based
 /// container.
 fn execute_trigger(install: &Installation, trigger: &TriggerCommand) -> Result<(), Error> {
-    // TODO: Use bind_ro for etc
     let isolation = Container::new(install.isolation_dir())
         .networking(false)
-        .hostname(environment::NAME)
-        .bind_rw(install.root.join("etc"), "/etc")
+        .override_accounts(false)
+        .bind_ro(install.root.join("etc"), "/etc")
         .bind_rw(install.staging_path("usr"), "/usr")
         .work_dir("/");