mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-10-20 15:51:52 -09:00
Code Issues Packages Projects Releases Wiki Activity

support/docker/Dockerfile: make $HOME folder read-only

Browse Source 
The $HOME folder of the br-user inside the container is currently
read-write for the br-user. However, practically speaking, it is only
read-write when the UID of the user running the container from the
host machine is 1000, equal to the UID of the br-user inside the
container. For any other UID on the host machine, the $HOME folder is
in fact already read-only.

Because we do not expect Buildroot to write into $HOME, and in order
to have a consistent behavior regardless of the UID of the user on the
host machine, we change our Docker image to make the $HOME folder of
the br-user entirely non-writable.

Suggested-by: Peter Korsgaard <peter@korsgaard.com>
Signed-off-by: Thomas Petazzoni <thomas.petazzoni@bootlin.com>
Signed-off-by: Peter Korsgaard <peter@korsgaard.com>
This commit is contained in:
Thomas Petazzoni
2025-12-26 15:59:59 +01:00
committed by Peter Korsgaard
parent 56992f7825
commit fac6d92a27
1 changed files with 4 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
support/docker/Dockerfile
View File

@@ -95,6 +95,10 @@ RUN sed -i 's/# \(en_US.UTF-8\)/\1/' /etc/locale.gen && \
RUN useradd -ms /bin/bash br-user && \
chown -R br-user:br-user /home/br-user
# Make the br-user home directory not writable, even for br-user
# itself, to catch builds writing into $HOME
RUN chmod 555 /home/br-user
USER br-user
WORKDIR /home/br-user
ENV HOME=/home/br-user