-
Notifications
You must be signed in to change notification settings - Fork 69
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Should the platform spec guarantee $HOME
!= $CNB_APP_DIR
#186
Comments
I've updated this issue to leave the choice of "same paths" vs "different paths" open (since I think there are arguments for and against both), so long as the spec defines which platforms should pick, in order to improve buildpack portability and prevent platform-specific security issues. |
The spec required that the lifecycle does not modify the value of I could see an argument for explicitly forbidding the value of What interesting is that setting Maybe we should also forbid buildpacks from setting |
I agree
That makes sense. Are any other env vars we should consider putting on a deny list. Setting |
👋 I'd like to suggest making it clear what changes/restrictions will be applied to the build environment and what will be applied to the launch environment. With classic Heroku buildpacks, I opened heroku/cnb-shim#23 because we need to make sure that |
Having worked through more of the compatibility analysis for the Heroku classic buildpack migration from building under As such, I would advocate for the CNB spec saying that HOME (both build time and runtime) must be a different path than the app directory.
Agree
Just to close the loop here -- the CNB shim PR has since been updated to use an approach that wouldn't be affected by buildpacks not being allowed to set HOME. |
Thanks for the update @edmorley! |
For our upcoming Ubuntu 24.04-based images, we've stopped overriding This may require some apps to make changes when migrating from our classic buildpacks to CNBs, but I think it's for the best long term. |
$HOME
!= $CNB_APP_DIR
Currently the CNB platform spec says:
However it doesn't make any guarantees as to whether
$HOME
is set to the same path as$CNB_APP_DIR
or not.This might seem like a trivial implementation detail, but with classic buildpacks on Heroku, several buildpacks write to
$HOME
during the build, treating it as an ephemeral directory that won't be included in the build output.For example the heroku-buildpack-github-netrc buildpack intentionally writes to
$HOME
, knowing that various tooling automatically uses such a.netrc
for authentication:https://github.com/timshadel/heroku-buildpack-github-netrc/blob/5e417127367e49fdf4243da4798d89be474bf709/bin/compile#L30-L40
I'm concerned about this scenario:
$HOME
and$CNB_APP_DIR
as different paths on the filesystem$HOME
and$CNB_APP_DIR
being equivalent.netrc
is then saved in the runtime image (and potentially served publicly, if their web server is configured suboptimally)$HOME
etc (and why would they, since on the most part the exact path used for$HOME
is irrelevant for builds)There are also cases where buildpacks unknowingly write to
$HOME
. For example, imagine a Python buildpack that intentionally caches onlysite-packages
and not pip's cache (so doesn't explicitly change the pip cache directory to be in<layers>/...
), but forgets to pass--no-cache-dir
to the pip install invocation. This would results in pip's http/wheel cache being saved to the default path of$HOME/.cache/pip
, which could easily go unnoticed on platform A in the scenario above. However on platform B, this would result in the pip cache being included in the runtime image, bloating it (which at least isn't a security issue, but still not ideal).As such I was wondering whether the platform spec should define whether
$HOME
is (or is not) equivalent to the$CNB_APP_DIR
path? I'm somewhat undecided to to whether "the same path" or "different paths" is best -- so long as the choice is consistent across platforms to improve buildpack portability and prevent platform-specific security issues.This issue is something that's also come up for Heroku classic buildpacks, since we're exploring moving the build directory from a directory under
/tmp
to/app
(so we have path parity between build-time and run-time, to resolve relocatability issues). However currently we have$HOME
set to/app
, so unless we change$HOME
to something else (which itself will cause compatibility issues), we're going to have the same path for both$HOME
and the build directory and so have to perform outreach for the netrc buildpacks et al.cc @hone @jabrown85
The text was updated successfully, but these errors were encountered: