cmd: drop privileges at container start instead of relying on the image

Author: pietroalbini

CHANGELOG.md

@@ -23,6 +23,8 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 - **BREAKING**: all functions and methods inside `cmd` now return `CommandError`.
 - `winapi` is no longer required on unix; `nix` is no longer required on windows.
 - Relaxed lifetime restrictions of `Build::cmd` and `Build::cargo`.
+- The requirement of using an image similar to `crates-build-env` has been
+  lifted, and it's now possible to use any Docker image for the sandbox.
 
 ## [0.9.0] - 2020-07-01
 

src/cmd/mod.rs

@@ -389,7 +389,7 @@ impl<'w, 'pl> Command<'w, 'pl> {
                 .cmd(cmd);
 
             if let Some(user) = native::current_user() {
-                builder = builder.env("MAP_USER_ID", user.user_id.to_string());
+                builder = builder.user(user.user_id, user.group_id);
             }
 
             for (key, value) in self.env {

src/cmd/sandbox.rs

@@ -143,6 +143,7 @@ pub struct SandboxBuilder {
     memory_limit: Option<usize>,
     cpu_limit: Option<f32>,
     workdir: Option<String>,
+    user: Option<String>,
     cmd: Vec<String>,
     enable_networking: bool,
 }
@@ -156,6 +157,7 @@ impl SandboxBuilder {
             workdir: None,
             memory_limit: None,
             cpu_limit: None,
+            user: None,
             cmd: Vec::new(),
             enable_networking: true,
         }
@@ -216,6 +218,11 @@ impl SandboxBuilder {
         self
     }
 
+    pub(super) fn user(mut self, user: u32, group: u32) -> Self {
+        self.user = Some(format!("{}:{}", user, group));
+        self
+    }
+
     fn create(self, workspace: &Workspace) -> Result<Container<'_>, CommandError> {
         let mut args: Vec<String> = vec!["create".into()];
 
@@ -253,6 +260,11 @@ impl SandboxBuilder {
             args.push(limit.to_string());
         }
 
+        if let Some(user) = self.user {
+            args.push("--user".into());
+            args.push(user);
+        }
+
         if !self.enable_networking {
             args.push("--network".into());
             args.push("none".into());

tests/buildtest/inside_docker.rs

@@ -63,10 +63,9 @@ impl CommandExt for Command {
     fn map_user_group(&mut self) -> Result<&mut Self, Error> {
         use std::os::unix::fs::MetadataExt;
         let gid = std::fs::metadata(DOCKER_SOCKET)?.gid();
-        self.arg("-e")
-            .arg(format!("MAP_USER_ID={}", nix::unistd::Uid::effective()))
-            .arg("-e")
-            .arg(format!("MAP_GROUP_ID={}", gid));
+        let uid = nix::unistd::Uid::effective();
+
+        self.arg("--user").arg(format!("{}:{}", uid, gid));
         Ok(self)
     }