Add a uid/gid flag to spawn a container with non-zero uid/gid.

[maleadt]

Turns out tar behaves differently when id==0 -- habitat-sh/builder#365 (comment), which doesn't work in the single-user containers we spawn (breaking BinaryProvider) -- so add an option to create a user map that uses a different uid/gid.

Fixes #24

[maleadt]

/home/runner/.julia/artifacts/b75badd28f02d9a4824aa829a7537d1c6f39fb13/bin/sandbox: unrecognized option '--uid'

Doesn't look like the build local sandbox CI is actually using the local sandbox. Presumable Pkg.test uses a different environment that ignores the LocalPreferences.toml?

[giordano]

Presumable Pkg.test uses a different environment that ignores the LocalPreferences.toml?

Yes: JuliaLang/Pkg.jl#2500. You should have a separate test/Project.toml like FFTW.jl

[maleadt]

Doesn't seem to help here.

[giordano]

Maybe this is relevant?

[maleadt]

Ah, yes, so that's setting a global preferences. Seems pretty hacky, at this point we could just run julia --project test/runtests.jl and just not use Pkg.test...

[maleadt]

OK, only legit failures now.

[maleadt]

OK, all done. How do we want to proceed here? Merge with failures, rebuild UserNSSandbox_jll, and re-run CI to verify?

[maleadt]

@staticfloat, re. #24 (comment), I take it you're opposed to this? I don't see an alternative though, su or similar doesn't work in the userns, and id=0 really does make software behave differently.

[staticfloat]

I take it you're opposed to this?

Actually, I didn't really think that the patch to userns_sandbox.c would be so small, so I'm totally open to this change. In fact, it may be quite useful for BB to build things as non-root!

[giordano]

it may be quite useful for BB to build things as non-root!

I thought having a single user helped with mapping permissions 🤔

[staticfloat]

Indeed it does, but this nicely dodges the problem by keeping things as a single-user system, it just allows using a UID that is nonzero. I think we will want to have the BB sandbox default to using the same numeric ID as the originating user, which will even allow us to avoid the chown calls we have to make after the Docker runner finishes.

[staticfloat]

I'm quite happy with this, with the one exception that using Tar.jl was one part of the hope that I had that this package would be able to work on Windows without further binary dependencies. :(

I guess we can work towards that in the future, in the Tar.jl repo.