Skip to content

Commit 1cbb16c

Browse files
rbrenxingyaoww
rbren
and
xingyaoww
authored
allow running app as root (OpenHands#1651)
* allow running app as root * better entrypoint mgmt * add nosetup option * remove comments * create docker group if it doesnt exist * better docker group mgmt * cast bools better * fix playwright * fix playwright for root * fix root source ~/.bashrc hangs by create clean bashrc --------- Co-authored-by: Xingyao Wang <[email protected]>
1 parent 968b4d7 commit 1cbb16c

3 files changed

Lines changed: 52 additions & 25 deletions

File tree

‎containers/app/Dockerfile‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -73,4 +73,8 @@ COPY --chown=opendevin:app --chmod=770 --from=frontend-builder /app/dist ./front
7373
COPY --chown=opendevin:app --chmod=770 ./containers/app/entrypoint.sh /app/entrypoint.sh
7474

7575
USER root
76-
CMD ["/app/entrypoint.sh"]
76+
77+
WORKDIR /app
78+
79+
ENTRYPOINT ["/app/entrypoint.sh"]
80+
CMD ["uvicorn", "opendevin.server.listen:app", "--host", "0.0.0.0", "--port", "3000"]

‎containers/app/entrypoint.sh‎

Lines changed: 39 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,13 @@
11
#!/bin/bash
2-
# check user is root
2+
set -eo pipefail
3+
4+
echo "Starting OpenDevin..."
5+
if [[ $NO_SETUP == "true" ]]; then
6+
echo "Skipping setup, running as $(whoami)"
7+
"$@"
8+
exit 0
9+
fi
10+
311
if [ "$(id -u)" -ne 0 ]; then
412
echo "The OpenDevin entrypoint.sh must run as root"
513
exit 1
@@ -11,30 +19,37 @@ if [ -z "$SANDBOX_USER_ID" ]; then
1119
fi
1220

1321
if [[ "$SANDBOX_USER_ID" -eq 0 ]]; then
14-
echo "SANDBOX_USER_ID cannot be 0. Please run with a different user id."
15-
exit 1
16-
fi
17-
18-
# change uid of opendevin user to match the host user
19-
# but the group id is not changed, so the user can still access everything under /app
20-
if ! useradd -l -m -u $SANDBOX_USER_ID -s /bin/bash enduser; then
21-
echo "Failed to create user enduser with id $SANDBOX_USER_ID. Moving opendevin user."
22-
incremented_id=$(($SANDBOX_USER_ID + 1))
23-
usermod -u $incremented_id opendevin
22+
echo "Running OpenDevin as root"
23+
export RUN_AS_DEVIN=false
24+
mkdir -p /root/.cache/ms-playwright/
25+
mv /home/opendevin/.cache/ms-playwright/ /root/.cache/
26+
"$@"
27+
else
28+
echo "Setting up enduser with id $SANDBOX_USER_ID"
2429
if ! useradd -l -m -u $SANDBOX_USER_ID -s /bin/bash enduser; then
25-
echo "Failed to create user enduser with id $SANDBOX_USER_ID for a second time. Exiting."
26-
exit 1
30+
echo "Failed to create user enduser with id $SANDBOX_USER_ID. Moving opendevin user."
31+
incremented_id=$(($SANDBOX_USER_ID + 1))
32+
usermod -u $incremented_id opendevin
33+
if ! useradd -l -m -u $SANDBOX_USER_ID -s /bin/bash enduser; then
34+
echo "Failed to create user enduser with id $SANDBOX_USER_ID for a second time. Exiting."
35+
exit 1
36+
fi
37+
fi
38+
usermod -aG app enduser
39+
# get the user group of /var/run/docker.sock and set opendevin to that group
40+
DOCKER_SOCKET_GID=$(stat -c '%g' /var/run/docker.sock)
41+
echo "Docker socket group id: $DOCKER_SOCKET_GID"
42+
if getent group $DOCKER_SOCKET_GID; then
43+
echo "Group with id $DOCKER_SOCKET_GID already exists"
44+
else
45+
echo "Creating group with id $DOCKER_SOCKET_GID"
46+
groupadd -g $DOCKER_SOCKET_GID docker
2747
fi
28-
fi
29-
30-
usermod -aG app enduser
31-
mkdir -p /home/enduser/.cache/ms-playwright/
32-
mv /home/opendevin/.cache/ms-playwright/ /home/enduser/.cache/
3348

34-
# get the user group of /var/run/docker.sock and set opendevin to that group
35-
DOCKER_SOCKET_GID=$(stat -c '%g' /var/run/docker.sock)
36-
echo "Docker socket group id: $DOCKER_SOCKET_GID"
37-
usermod -aG $DOCKER_SOCKET_GID enduser
49+
mkdir -p /home/enduser/.cache/ms-playwright/
50+
mv /home/opendevin/.cache/ms-playwright/ /home/enduser/.cache/
3851

39-
# switch to the user and start the server
40-
su enduser -c "cd /app && uvicorn opendevin.server.listen:app --host 0.0.0.0 --port 3000"
52+
usermod -aG $DOCKER_SOCKET_GID enduser
53+
echo "Running as enduser"
54+
su enduser /bin/bash -c "$*"
55+
fi

‎opendevin/runtime/plugins/mixin.py‎

Lines changed: 8 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -18,6 +18,14 @@ class PluginMixin:
1818

1919
def init_plugins(self: SandboxProtocol, requirements: list[PluginRequirement]):
2020
"""Load a plugin into the sandbox."""
21+
22+
# clean-up ~/.bashrc and touch ~/.bashrc
23+
exit_code, output = self.execute('rm -f ~/.bashrc && touch ~/.bashrc')
24+
if exit_code != 0:
25+
raise RuntimeError(
26+
f'Failed to clean-up ~/.bashrc with exit code {exit_code} and output {output}'
27+
)
28+
2129
for requirement in requirements:
2230
# copy over the files
2331
self.copy_to(requirement.host_src, requirement.sandbox_dest, recursive=True)

0 commit comments

Comments
 (0)