Skip to content

fix: devspaces sudo support with correct UID and user setup #735

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
shatakshiiii merged 3 commits into from
Apr 22, 2026
Merged

fix: devspaces sudo support with correct UID and user setup #735

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
52955db
fix: devspaces sudo support with correct UID and user setup
leogallego Apr 21, 2026
e3daaf3
fix tox -e lint
shatakshiiii Apr 22, 2026
7deafcd
fix: add error handling for useradd in devspaces setup
leogallego Apr 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .config/dictionary.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,4 +39,5 @@ skopeo
unmarshal
unmarshalling
urandom
userdel
userns
2 changes: 2 additions & 0 deletions devfile.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,8 @@ components:
env:
- name: "ANSIBLE_COLLECTIONS_PATH"
value: "~/.ansible/collections:/usr/share/ansible/collections:/projects/ansible-devspaces-demo/collections"
- name: "ADT_CONTAINER_ENGINE"
value: "podman"
commands:
- id: molecule-create
exec:
Expand Down
3 changes: 2 additions & 1 deletion devspaces/Containerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,7 +16,8 @@ RUN --mount=type=bind,target=. --mount=type=cache,dst=/var/cache/dnf --mount=typ

ENV BUILDAH_ISOLATION=chroot

USER 10001
# Reflect the UID that the SCC will force the workspace to run as.
USER 1000

ENTRYPOINT ["/entrypoint.sh"]
CMD ["tail", "-f", "/dev/null"]
13 changes: 13 additions & 0 deletions devspaces/context/setup.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,19 @@ setcap cap_setuid+ep /usr/bin/newuidmap
setcap cap_setgid+ep /usr/bin/newgidmap
touch /etc/subgid /etc/subuid
chown 0:0 /etc/subgid /etc/subuid
# Remove the base image entries for user
if id user >/dev/null 2>&1
then
userdel user
# Add the user with the UID that the SCC will enforce
if ! useradd -u 1000 -G wheel,root -d /home/user --shell /bin/bash -m user; then
echo "ERROR: Failed to create user with UID 1000" >&2
exit 1
fi
usermod -L user
chmod 400 /etc/shadow
chown -R user /home/user
fi

if [[ "${ENABLE_NOPASSWD_SUDO:-false}" == "true" ]]; then
echo "%wheel ALL=(ALL) NOPASSWD: ALL" > /etc/sudoers.d/wheel-nopasswd
Expand Down
Loading