chmod in entrypoint takes ages about docker-images HOT 10 CLOSED

Looking at another discussion on a similar topic, the slowdowns are likely most prominent when the overlay2 storage driver is used.

from docker-images.

FWIW it looks like CircleCI also uses overlay2. Definitely have seen some slowdown due to this personally, but not to the tune of 8mins. Probably closer to seconds. Though haven't been hit bad enough personally to need to measure. Wonder if there is something more going on in your case. Perhaps a slow OS FS?

Would be open to other options. The main challenge is that we need to make sure the UID of the user in the container matches that of the user outside the container. Otherwise we basically can't do anything with the mounted directories. Given how the feedstocks are setup, this includes everything from updating packages, doing the build, etc.

from docker-images.

We also use a linux-anvil inspired image for our internal CI, and since our I/O budget is a bit tight, this was slightly annoying. What we do is simply to chown the conda dir like:

# lucky group gets permissions to write in the conda dir
RUN groupadd -g 32767 lucky
RUN chgrp -R lucky /opt/conda && chmod -R g=u /opt/conda

And then add the unprivileged user to the "lucky" group each time we spin a container.

from docker-images.

@gqmelo, thoughts?

from docker-images.

I tried to reproduce the issue on Ubuntu 18.04, and after configuring docker to use overlay2 instead of aufs it indeed slowed the build considerably. It took about 2.5 min just to execute the chown/chmod commands, so it seems realistic to say the 8 min mentioned is caused by overlay2.

By reading the issue mentioned before, there is still no fix for that, so the workaround suggested by @sdvillal seems good. It would also make the entrypoint much simpler, as we could move a bunch of code to the Dockerfile.

I can't see any downside for this solution. We would still be creating files on build_artifacts with the host UID.

from docker-images.

We could also look at using fixuid. Basically a tool intended to solve this problem.

from docker-images.

But it would face the same problem. From the README:

changes all file permissions for old dockeruser:dockergroup to

from docker-images.

RUN groupadd -g 32767 lucky

Is this number meaningful or is it arbitrary, @sdvillal?

from docker-images.

Arbitrary.

from docker-images.

#68 tackles this

from docker-images.