Make gcp-linux example template use a non-root user #2480
Conversation
examples/templates/gcp-linux/main.tf
Outdated
| useradd -m -s /bin/bash "${local.linux_user}" | ||
| echo "${local.linux_user} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder-user | ||
| exec sudo -u "${local.linux_user}" sh -c '${coder_agent.dev.init_script}' |
There was a problem hiding this comment.
Since it's a persistent root disk, wouldn't this fail on subsequent boots since it doesn't check if the user already exists first?
There was a problem hiding this comment.
That's a good point actually Dean -- I didn't know this before, but apparently on EC2 the user metadata script only runs on first boot by default, whereas on GCP it runs on every boot.
There was a problem hiding this comment.
Yeah, good catch.
I originally wanted to just take the same approach that we use for AWS and create the user with cloud-init, which I now realize would have handled this. But unfortunately, cloud-init is excluded from the GCE variants of the Debian cloud images: https://salsa.debian.org/cloud-team/debian-cloud-images/-/issues/41
examples/templates/gcp-linux/main.tf
Outdated
| /root/coder_agent.sh | ||
|
|
||
| useradd -m -s /bin/bash "${local.linux_user}" | ||
| echo "${local.linux_user} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder-user |
There was a problem hiding this comment.
| echo "${local.linux_user} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder-user | |
| [ ! -e /etc/sudoers.d/coder-user ] && echo "${local.linux_user} ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/coder-user |
examples/templates/gcp-linux/main.tf
Outdated
| export HOME=/root | ||
| /root/coder_agent.sh | ||
|
|
||
| useradd -m -s /bin/bash "${local.linux_user}" |
There was a problem hiding this comment.
| useradd -m -s /bin/bash "${local.linux_user}" | |
| grep "${local.linux_user}" /etc/passwd > /dev/null 2>&1 || useradd -m -s /bin/bash "${local.linux_user}" |
|
I modified the suggested fix slightly so that we only create |
|
This Pull Request is becoming stale. In order to minimize WIP, prevent merge conflicts and keep the tracker readable, I'm going close to this PR in 3 days if there isn't more activity. |
|
This Pull Request is becoming stale. In order to minimize WIP, prevent merge conflicts and keep the tracker readable, I'm going close to this PR in 3 days if there isn't more activity. |
Create a non-root user on startup and run the init script as that user, similar to what we do for AWS.
See issue #2178