fix: run plugins as the instance login user (not hardcoded ec2-user)#17
Merged
Conversation
Use the new {{ instance.login_user }} template var (spawn) instead of hardcoding
ec2-user, so services + files land under the real login user (e.g. scttfrdmn):
- jupyterlab/code-server/vscode-tunnel: systemd User= + config/home paths
- rclone: rclone.conf + mount owner + systemd User=
- docker: usermod -aG docker <login_user>
- github-actions-runner: chown runner dir + svc.sh install <login_user>
(config.sh already ran as_user)
Caught in the smoke: jupyterlab/code-server had launched as ec2-user, writing to
/home/ec2-user instead of the login user's home. Requires spawn with
instance.login_user (merged, ships next release). Re-validated all 8 --strict.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up to the registry-expansion smoke, which caught jupyterlab/code-server launching as
ec2-userand writing to/home/ec2-userinstead of the real login user (e.g.scttfrdmn).Uses the new
{{ instance.login_user }}template variable (spore-host/spawn#425) instead of hardcodingec2-user, so services and files land under the real login user:User=+ config/home paths derived from the login user's home (getent passwd).rclone.conf, mount-path owner, and systemdUser=.usermod -aG docker <login_user>.chownthe runner dir +svc.sh install <login_user>(theconfig.shstep already ranas_user).All 8 re-validated with
spawn plugin validate --strict(built from spawnmain, which hasinstance.login_user).Requires
The spawn side (spore-host/spawn#425, merged) must be released before these render on an instance — the current released spawn (v0.88.0) doesn't populate
instance.login_useryet. Cut spawn v0.89.0 first, then this is live. (--strictlint passes regardless, since the ref is syntactically valid.)