Draft
Secure Net::OpenSSH control sockets in backend containers#120
Conversation
Copilot
AI
changed the title
[WIP] Fix permissions issue in netdisco-backend container for SSH jobs
Secure Net::OpenSSH control sockets in backend containers
Jul 23, 2026
rc9000
reviewed
Jul 23, 2026
| mkdir /home/netdisco/run && \ | ||
| chown netdisco:0 /home/netdisco/run && chmod 770 /home/netdisco/run && \ | ||
| ln -s run/netdisco-daemon.pid /home/netdisco/netdisco-daemon.pid && \ | ||
| ln -s run/netdisco-backend.pid /home/netdisco/netdisco-backend.pid |
Member
There was a problem hiding this comment.
will this work when the file is not there yet or later deleted and recreated?
There was a problem hiding this comment.
Pull request overview
This PR adjusts permissions and runtime paths in the Netdisco container images so Net::OpenSSH no longer rejects its control-socket directory under /home/netdisco, while still supporting OpenShift-style arbitrary UIDs by moving writable runtime state into a group-0-writable subdirectory and extending CI smoke checks.
Changes:
- Make
/home/netdisconon-group-writable (0755) to satisfy Net::OpenSSH security checks. - Add
/home/netdisco/run(group 0 writable) and symlink PID files into it. - Extend the smoke workflow to validate home permissions and PID-file writability under an arbitrary UID.
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.
| File | Description |
|---|---|
netdisco-base/Dockerfile |
Tightens home directory permissions, introduces /home/netdisco/run, and symlinks PID files into it. |
.github/workflows/smoke-test.yml |
Adds smoke assertions for secure home mode and PID-file write access under an arbitrary UID. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
Comment on lines
+68
to
+71
| docker run --rm --user 1000050000 \ | ||
| --entrypoint /bin/ash \ | ||
| "localhost:5000/netdisco:$tag" \ | ||
| -ec 'echo "checking secure home permissions"; test "$(stat -c %a /home/netdisco)" = 755; echo "checking PID file access"; : > /home/netdisco/netdisco-backend.pid; rm /home/netdisco/run/netdisco-backend.pid' |
| RUN chgrp -R 0 /home/netdisco && chmod -R g=u /home/netdisco && \ | ||
| chmod 755 /home/netdisco && \ | ||
| mkdir /home/netdisco/run && \ | ||
| chown netdisco:0 /home/netdisco/run && chmod 770 /home/netdisco/run && \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Net::OpenSSH rejects control-socket paths beneath the group-writable
/home/netdisco. The image must retain support for OpenShift randomized UIDs that require writable runtime state.Secure home directory
/home/netdiscoto0755, allowing Net::OpenSSH to create and validate~/.libnet-openssh-perl.Preserve randomized-UID runtime support
/home/netdisco/run.