fix(docker-postgres): use system sg binary with SUID for group switching - #797
Conversation
shunkakinoki
added
the
bug
|
You do not have enough credits to review this pull request. Please purchase more credits to continue. |
Summary of ChangesHello @shunkakinoki, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request resolves an issue where the Highlights
Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
Mesa DescriptionTL;DRSwitch docker-postgres to use What changed?
Description generated by Mesa. Update settings |
📝 WalkthroughWalkthroughThis change modifies the docker-postgres service startup script to use the system's Changes
Estimated code review effort🎯 2 (Simple) | ⏱️ ~8 minutes Possibly related PRs
Suggested labels
Poem
🚥 Pre-merge checks | ✅ 4✅ Passed checks (4 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing touches
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request fixes an issue with group permissions when running the docker-postgres service by using the system's sg binary instead of the one from Nix packages. While this is a functional fix, it introduces a hardcoded path to /usr/bin/sg, which is an impurity in the Nix configuration. This can compromise the reproducibility and portability of the module. I've added a review comment with a suggestion to make this dependency more explicit and add a runtime check to improve robustness and provide clearer error messages on systems where this binary might be missing.
| # Use system sg (has SUID) since systemd user session lacks docker group | ||
| startPostgresWrapper = pkgs.writeShellScript "start-postgres-wrapper" '' | ||
| exec ${pkgs.shadow}/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}" | ||
| exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}" |
There was a problem hiding this comment.
Hardcoding the path /usr/bin/sg introduces an impurity into the Nix configuration. This makes the setup dependent on the state of the host system and can lead to failures on systems where sg is not present at this location (e.g., some minimal container environments or differently structured distributions). This undermines the reproducibility and portability that Nix aims to provide.
While this is a pragmatic fix for the SUID issue, a more robust approach would be to add a check for the existence of the binary within the wrapper script. This provides a clearer error message if it's missing and makes debugging easier if this module is used on an unsupported system.
if [ ! -x "/usr/bin/sg" ]; then
echo "Error: /usr/bin/sg not found or not executable. A 'sg' binary with SUID is required." >&2
exit 1
fi
exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}"
There was a problem hiding this comment.
Pull request overview
This PR fixes a setuid permission issue with the docker-postgres systemd user service. The Nix-packaged sg binary from ${pkgs.shadow} cannot have the SUID bit set (Nix store restriction), causing "setgid: Operation not permitted" errors. The fix switches to the system /usr/bin/sg binary which has proper SUID permissions.
Changes:
- Replace
${pkgs.shadow}/bin/sgwith/usr/bin/sgfor group switching in the docker-postgres wrapper script - Add explanatory comment about why system sg binary is needed
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # Use system sg (has SUID) since systemd user session lacks docker group | ||
| startPostgresWrapper = pkgs.writeShellScript "start-postgres-wrapper" '' | ||
| exec ${pkgs.shadow}/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}" | ||
| exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}" |
There was a problem hiding this comment.
Hardcoding /usr/bin/sg without a fallback check could fail on NixOS systems where setuid wrappers are in /run/wrappers/bin/sg. The codebase has an established pattern (seen in tailscale and k3s modules) for handling setuid binaries with fallback checks:
- First check
/run/wrappers/bin/sg(NixOS convention for setuid wrappers) - Then fall back to
/usr/bin/sg(standard Linux) - Optionally use
command -v sgas a final fallback
Consider implementing a similar pattern here with proper error handling if none of these locations have the sg binary. This would make the code more robust across different Linux distributions and NixOS vs non-NixOS systems.
| exec /usr/bin/sg docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}" | |
| # Locate sg with NixOS-aware fallbacks | |
| if [ -x /run/wrappers/bin/sg ]; then | |
| sg_bin=/run/wrappers/bin/sg | |
| elif [ -x /usr/bin/sg ]; then | |
| sg_bin=/usr/bin/sg | |
| elif sg_bin="$(command -v sg 2>/dev/null)"; then | |
| : | |
| else | |
| echo "Error: 'sg' binary not found in /run/wrappers/bin, /usr/bin, or PATH." >&2 | |
| exit 1 | |
| fi | |
| exec "$sg_bin" docker -c "${pkgs.bash}/bin/bash ${./start-postgres.sh}" |
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
There was a problem hiding this comment.
1 issue found across 1 file
Prompt for AI agents (all issues)
Check if these issues are valid — if so, understand the root cause of each and fix them.
<file name="home-manager/services/docker-postgres/default.nix">
<violation number="1" location="home-manager/services/docker-postgres/default.nix:6">
P2: Hardcoding `/usr/bin/sg` makes the service fail on NixOS or other non-FHS systems where `/usr/bin/sg` is missing. Consider using a configurable wrapper path or a platform-specific sg path instead of a fixed `/usr/bin` dependency.</violation>
</file>
Reply with feedback, questions, or to request a fix. Tag @cubic-dev-ai to re-run a review.
d5109b4 to
c517d3d
Compare
…NixOS compatibility Add smart wrapper that: 1. Tries docker directly first (works on NixOS or when user has docker group) 2. Falls back to /run/wrappers/bin/sg on NixOS (SUID wrapper) 3. Falls back to /usr/bin/sg on non-NixOS (system binary with SUID) The Nix-packaged sg binary lacks the SUID bit required for setgid/setgroups operations, so we need to use system binaries with proper permissions.
Changes
Use a smart wrapper script for docker group switching that works on both NixOS and non-NixOS Linux:
Technical Details
The wrapper tries in order:
/run/wrappers/bin/sg- NixOS SUID wrapper (if available)/usr/bin/sg- System binary with SUID (non-NixOS)This is needed because:
${pkgs.shadow}/bin/sglacks the SUID bit (Nix store can't have setuid binaries)/run/wrappers/bin/sgis available viasecurity.wrappersTest plan
make buildpassesGenerated with Claude Code by Claude Opus 4.5