nodejsfunction/bundling: files bundled via Docker should be owned by the running user

[rix0rrr]

Describe the feature

When running a bundling command in Docker (for example using NodejsFunction, but also other commands that do bundling in a Docker container), the generated files will be owned by whatever user the Docker daemon is running as.

Use Case

On MacOS, the Docker Desktop daemon is typically running as the user, and so files generated from bundling will be owned by the user, which is good.

On Linux, the Docker daemon is typically running as root, and so files generated from bundling will be owned by root. This means they cannot be cleaned up afterwards! This is a huge hassle, and has cost me a week debugging build failures on GitHub Actions.

The problem does not exhibit on CodeBuild, because on CodeBuild the user running the CDK CLI is root; but on GitHub Actions there is a specific runner user, distinct from root... and it is not allowed to touch files created by root.

Proposed Solution

chown() in the container will work, and the uids are the same between container and host (if I understand the situation correctly).

It's just that the container will most likely not have access to the host system's user database.

What we should do is to pass the current process' uid into the container, and inside the container chown all the files it created to the right uid. I'm like 90% confident this should work 😅 .

This should probably be implemented as part of the generic "run a bundling command in Docker" feature; it shows most commonly through the NodejsFunction construct, but that should not be the place to fix it. It applies to all Docker bundling commands.

Also, someone needs to go figure out what the story on Windows is, because I have no idea.

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

Environment details (OS name and version, etc.)

[rix0rrr]

There's something in the code to do this already. I don't understand why it doesn't work on GitHub Actions though...