feat: full rootless setup (#165)

* use local devtools configs instead of global ones

* make docker image rootless

* add migration notes

* fix setup command

* fix regress jo

docker/01-docker.ini

@@ -0,0 +1,2 @@
+[web]
+host = $AHRIMAN_HOST

docker/Dockerfile

@@ -80,7 +80,6 @@ FROM archlinux:base AS ahriman
 # image configuration
 ENV AHRIMAN_ARCHITECTURE="x86_64"
 ENV AHRIMAN_DEBUG=""
-ENV AHRIMAN_FORCE_ROOT=""
 ENV AHRIMAN_HOST="0.0.0.0"
 ENV AHRIMAN_MULTILIB="yes"
 ENV AHRIMAN_OUTPUT=""
@@ -91,7 +90,6 @@ ENV AHRIMAN_POSTSETUP_COMMAND=""
 ENV AHRIMAN_PRESETUP_COMMAND=""
 ENV AHRIMAN_REPOSITORY="aur"
 ENV AHRIMAN_REPOSITORY_SERVER=""
-ENV AHRIMAN_REPOSITORY_ROOT="/var/lib/ahriman/ahriman"
 ENV AHRIMAN_UNIX_SOCKET=""
 ENV AHRIMAN_USER="ahriman"
 ENV AHRIMAN_VALIDATE_CONFIGURATION="yes"
@@ -135,11 +133,15 @@ RUN find "/var/cache/pacman/pkg" "/var/lib/pacman/sync" -type "f,l" -delete && \
 VOLUME ["/var/lib/ahriman"]
 
 # minimal runtime ahriman setup
+RUN systemd-machine-id-setup
+COPY "docker/01-docker.ini" "/etc/ahriman.ini.d/01-docker.ini"
 ## FIXME since 1.0.4 devtools requires dbus to be run, which doesn't work now in container
 COPY "docker/systemd-nspawn.sh" "/usr/local/bin/systemd-nspawn"
 ## entrypoint setup
 COPY "docker/entrypoint.sh" "/usr/local/bin/entrypoint"
 COPY "docker/entrypoint-web.sh" "/usr/local/bin/entrypoint-web"
+
+USER ahriman
 ENTRYPOINT ["entrypoint"]
 # default command
 CMD ["repo-update", "--refresh"]

docker/entrypoint-web.sh

@@ -2,4 +2,9 @@
 # Special workaround for running web service in github actions, must not be usually used in real environment,
 # consider running web command explicitly instead
 
-exec entrypoint web "$@"
+if (( EUID == 0 )); then
+    chown ahriman:ahriman /var/lib/ahriman
+    exec sudo -E -u ahriman -- entrypoint web "$@"
+fi
+
+exec entrypoint web "$@"

docker/entrypoint.sh

@@ -3,30 +3,15 @@
 set -e
 [ -n "$AHRIMAN_DEBUG" ] && set -x
 
-# configuration tune
-cat <<EOF > "/etc/ahriman.ini.d/01-docker.ini"
-[repository]
-root = $AHRIMAN_REPOSITORY_ROOT
-
-[web]
-host = $AHRIMAN_HOST
-
-EOF
-
 AHRIMAN_DEFAULT_ARGS=("--architecture" "$AHRIMAN_ARCHITECTURE")
 AHRIMAN_DEFAULT_ARGS+=("--repository" "$AHRIMAN_REPOSITORY")
 if [ -n "$AHRIMAN_OUTPUT" ]; then
     AHRIMAN_DEFAULT_ARGS+=("--log-handler" "$AHRIMAN_OUTPUT")
 fi
 
-# create repository root inside the [[mounted]] directory and set correct ownership
-[ -d "$AHRIMAN_REPOSITORY_ROOT" ] || mkdir "$AHRIMAN_REPOSITORY_ROOT"
-chown "$AHRIMAN_USER":"$AHRIMAN_USER" "$AHRIMAN_REPOSITORY_ROOT"
-
 # create .gnupg directory which is required for keys
 AHRIMAN_GNUPG_HOME="$(getent passwd "$AHRIMAN_USER" | cut -d : -f 6)/.gnupg"
 [ -d "$AHRIMAN_GNUPG_HOME" ] || mkdir -m700 "$AHRIMAN_GNUPG_HOME"
-chown "$AHRIMAN_USER":"$AHRIMAN_USER" "$AHRIMAN_GNUPG_HOME"
 
 # run built-in setup command
 AHRIMAN_SETUP_ARGS=("--build-as-user" "$AHRIMAN_USER")
@@ -54,19 +39,7 @@ ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" service-setup "${AHRIMAN_SETUP_ARGS[@]}"
 # validate configuration if set
 [ -n "$AHRIMAN_VALIDATE_CONFIGURATION" ] && ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" service-config-validate --exit-code
 
-# create machine-id which is required by build tools
-systemd-machine-id-setup &> /dev/null
-
 # special workaround to emulate /bin/bash entrypoint if first argument starts with /
 [[ "$1" =~ ^/.* ]] && exec "$@"
 
-# if AHRIMAN_FORCE_ROOT is set or command is unsafe we can run without sudo
-# otherwise we prepend executable by sudo command
-if [ -n "$AHRIMAN_FORCE_ROOT" ]; then
-    AHRIMAN_EXECUTABLE=("ahriman")
-elif ahriman help-commands-unsafe -- "$@" &> /dev/null; then
-    AHRIMAN_EXECUTABLE=("sudo" "-E" "-u" "$AHRIMAN_USER" "--" "ahriman")
-else
-    AHRIMAN_EXECUTABLE=("ahriman")
-fi
-exec "${AHRIMAN_EXECUTABLE[@]}" "${AHRIMAN_DEFAULT_ARGS[@]}" "$@"
+exec ahriman "${AHRIMAN_DEFAULT_ARGS[@]}" "$@"