Set HOME environment variable for runs-as user

Summary:
Fixes build issues around home permissions by setting `HOME` to the
unprivileged user's home directory once the "privileges dropped" build
phase has been reached.

Test Plan: Run `go test ./...`.

Reviewers: thcipriani, mobrovac, hashar, Jrbranaa, mmodell, #release-engineering-team

Reviewed By: mobrovac

Tags: #release-engineering-team

Differential Revision: https://phabricator.wikimedia.org/D686

4 files changed, 28 insertions, 12 deletions

diff --git a/build/instructions.go b/build/instructions.go
index 2676a75..eda651c 100644
--- a/build/instructions.go
+++ b/build/instructions.go
@@ -5,6 +5,7 @@ type InstructionType int
 const (
 	Run InstructionType = iota
 	Copy
+	Env
 )
 
 type Instruction struct {
diff --git a/config/runs.go b/config/runs.go
index f2756a5..7567685 100644
--- a/config/runs.go
+++ b/config/runs.go
@@ -25,25 +25,29 @@ func (run RunsConfig) InstructionsForPhase(phase build.Phase) []build.Instructio
 	switch phase {
 	case build.PhasePrivileged:
 		if run.In != "" {
-			ins = append(ins, []build.Instruction{{build.Run, []string{"mkdir -p ", run.In}}}...)
+			ins = append(ins, build.Instruction{build.Run, []string{"mkdir -p ", run.In}})
 		}
 
 		if run.As != "" {
-			ins = append(ins, []build.Instruction{
-				{build.Run, []string{
-					"groupadd -o -g ", strconv.Itoa(run.Gid), " -r ", run.As, " && ",
-					"useradd -o -m -r -g ", run.As, " -u ", strconv.Itoa(run.Uid), " ", run.As,
-				}},
-			}...)
+			ins = append(ins, build.Instruction{build.Run, []string{
+				"groupadd -o -g ", strconv.Itoa(run.Gid), " -r ", run.As, " && ",
+				"useradd -o -m -d /home/", run.As, " -r -g ", run.As,
+				" -u ", strconv.Itoa(run.Uid), " ", run.As,
+			}})
 
 			if run.In != "" {
-				ins = append(ins, []build.Instruction{
-					{build.Run, []string{
-						"chown ", run.As, ":", run.As, " ", run.In,
-					}},
-				}...)
+				ins = append(ins, build.Instruction{build.Run, []string{
+					"chown ", run.As, ":", run.As, " ", run.In,
+
+				}})
 			}
 		}
+	case build.PhasePrivilegeDropped:
+		if run.As != "" {
+			ins = append(ins, build.Instruction{build.Env, []string{
+				"HOME=\"/home/" + run.As + "\"",
+			}})
+		}
 	}
 
 	return ins
diff --git a/docker/compiler.go b/docker/compiler.go
index 0a16362..f398164 100644
--- a/docker/compiler.go
+++ b/docker/compiler.go
@@ -96,6 +96,8 @@ func CompileInstruction(buffer *bytes.Buffer, instruction build.Instruction) {
 		Writeln(buffer, append([]string{"RUN "}, instruction.Arguments...)...)
 	case build.Copy:
 		Writeln(buffer, "COPY [\"", instruction.Arguments[0], "\", \"", instruction.Arguments[1], "\"]")
+	case build.Env:
+		Writeln(buffer, "ENV ", strings.Join(instruction.Arguments, " "))
 	}
 }
 
diff --git a/docker/compiler_test.go b/docker/compiler_test.go
index c6fec1b..7f6ee87 100644
--- a/docker/compiler_test.go
+++ b/docker/compiler_test.go
@@ -52,3 +52,12 @@ func TestCompileInstructionCopy(t *testing.T) {
 
 	assert.Equal(t, "COPY [\"foo\", \"bar\"]\n", buffer.String())
 }
+
+func TestCompileInstructionEnv(t *testing.T) {
+	buffer := new(bytes.Buffer)
+	instruction := build.Instruction{build.Env, []string{"foo=bar", "baz=qux"}}
+
+	docker.CompileInstruction(buffer, instruction)
+
+	assert.Equal(t, "ENV foo=bar baz=qux\n", buffer.String())
+}