Use the same non-privileged UID inside the container as that of the host user

[atrosinenko]

This fixes the contents of ./ccache and ./output directories being owned by root.

[atrosinenko]

I plan tuning this patch a bit, so that $ROOT/output, $ROOT/ccache, $ROOT/tmp are created with the right ownership/permissions.

[atrosinenko]

Updated the PR, now it is ready for review.

[kovdan01]

So do we need to manually set this environment variable in the config file if we with to achieve the desired effect? If yes, could you please add a corresponding entry + short description to the config file + mention this variable in README?

Or is it some well-known automatically set environment variable? If yes, could you please clarify who is setting it?

[atrosinenko]

SUDO_USER is normally set by sudo itself:

Set to the login name of the user who invoked sudo.

Added a comment in 03a97e7, thanks.

[kovdan01]

So, does this imply that one might want to run build.sh under sudo for some reasons? I'm just not sure if it's a good idea... Maybe I'm missing smth though.

[atrosinenko]

So, does this imply that one might want to run build.sh under sudo for some reasons?

Yes, locally I usually run docker using sudo - maybe this is against the best practices, but I'm not sure. I could drop the part with SUDO_USER at all, as this seems to be the trickiest part of the PR. On the other hand, I'm not sure which are the best practices for other container engines, such as daemon-less Podman.

Frankly speaking, I'm a bit worried about this PR in general from the security perspective as it deals with going from non-privileged user to privileged one and vice versa. On the other hand, if the current user is able to launch rootful Ubuntu docker container and mount own directories as volumes into it, then exactly the same actions can be performed manually :)

[atrosinenko]

Maybe I could provide a much easier replacement for this PR. The most painful consequence of various files and directories being owned by root instead of the actual non-privileged user is host-build silently falling back to non-cached rebuilds.

I would expect that the host and containerized builds would not share object files most of the times anyway, so the only issue is that the host-build is technically unable to write its object files to ./ccache directory created by containerized build. This could be fixed by using separate ccache cache directories for the two variants of build.

[kovdan01]

This could be fixed by using separate ccache cache directories for the two variants of build.

Yeah, this would probably be the simplest fix which would not make a lot of assumptions about sudo-related stuff, user privileges, UID hardcoded, etc.

Would cost 1 extra "initial" build (if one wants to use both host and containerized build, they need to run initial build for each variant to have ccache initialized for both), but I guess it's not that huge cost and is acceptable

[atrosinenko]

Implemented the alternative approach in #27 (depends on #26 for preliminary refactoring).