checkout is owned by a different user inside the container

[junghans]

If the container runs as non-root user, the checkout might belows to a different user.

Example

name: CI
on: [push]
jobs:
  build:
    runs-on: ubuntu-latest
    container: votca/buildenv:latest
    steps:
      - uses: actions/checkout@master
        with:
          submodules: true
      - run: id
      - run: ls -l

The user is:

uid=1000(votca) gid=1000(votca) groups=1000(votca),10(wheel)

but the checkout is owned by uid 1001.

[junghans]

Ok, I got it, the checkout is done outside of the container and hence owned by 1001, adding options: --user 1001 to the container: block, seems like a good workaround.

[ethomson]

Glad you got this working - unfortunately, the docker containers can run as any user (as specified by the USER option in the Dockerfile) so there's very little control that we have over this. I'm going to close this issue, but if you have additional feedback, please see the GitHub Actions forum or contact us.

[junghans]

The problem is that the workaround above leads to other issues as the special user in the container had sudo rights, but of course, using a different user will not have that anymore.

[0x2b3bfa0]

Relevant again after Git 2.35.2 safe.directory feature:

• fatal: unsafe repository (REPO is owned by someone else) with ubuntu 20.04 container #760 (comment)
• Enforce safe directory #762 (comment)

[n1ngu]

Main issue is the docker image might be engineered to work only for the non-root non-1001 user, e.g. meaningful files being owned by a given UID and present on a certain home which will NOT be the /github/home set by github actions.

My current workaround is

jobs:
  xxx:
    runs-on: ubuntu-latest
    container:
      image: MYIMAGE
      options: --user=root
    steps:
    - uses: actions/checkout@v4
    - name: Fix UID
      shell: bash
      run: |
        usermod --uid 1001 MYUSER
        find RELEVANT_PATHS -maxdepth 1 -uid OLDUID -exec chown --recursive --verbose 1001 '{}' ';'
        chown --recursive --verbose 1001 .  # fix checkout uid
    - name: Do something
      shell: su --preserve-environment MYUSER {0}
      run: |
        touch hello

Biggest issue so far is most actions aren't ready for this corner case and will run as root, so I'll be patching UIDs all along the workflow. I think this is beyond the scope of this action but I am uncertain about where to report it.

[n1ngu]

Related https://github.com/orgs/community/discussions/26811