Change:
I have this totally normal config: Then I want to run Then inside the container, Bootstrap is compiled, but then emits this: My repository history is not too shallow. The only way to use the CI scripts seems to be to set . The reason download-ci-llvm doesn't work seems to be the ownership of the mount: So maybe this is an easy fix? Can we just run that somewhere? It seems to work, I'm just not sure where it would be run.
That script should set the uid of the processes inside the container to match what you use outside of the container and thus who owns the source repo: If you use podman, are you maybe using a version of podman which doesn't contain the literal string in ? And can you run outside and inside the container?
I am not using Podman
Outside the container: After
I assume this is related with your docker privileges (the user group assigned on docker). Can't reproduce this on my side.
That seems reasonable? What should that be instead?
should be able to handle this
That's very nice of you, but if I have a scuffed Docker setup on my dev machine I'd like to know in what way it's scuffed if you don't mind :sweat_smile:
By default, docker runs under root mode, and I believe this is the main issue here. On the other hand, podman runs in rootless mode by default: I was able to reproduce the problem by running podman under root privileges. I believe the problem here is more related to the nature of docker rather than an issue with your docker setup.
The snippet I mentioned in should ensure that the programs inside the container run as the same user as the one with which was invoked.
And when the user is root (e.g., running the script with root user), you get .

Discussion:
objdir=$root_dir/obj dist=$objdir/build/dist <ins> if [ -d "$root_dir/.git" ]; then IS_GIT_SOURCE=1 fi </ins> source "$ci_dir/shared.sh" CACHE_DOMAIN="${CACHE_DOMAIN:-ci-caches.rust-lang.org}"

args="$args --env SCCACHE_DIR=/sccache --volume $HOME/.cache/sccache:/sccache" fi <ins> # By default, container volumes are bound as read-only; therefore doing experimental work # or debugging within the container environment (such as fetching submodules and # building them) is not possible. Setting READ_ONLY_SRC to 0 enables this capability by # binding the volumes in read-write mode. if [ "$READ_ONLY_SRC" != "0" ]; then SRC_MOUNT_OPTION=":ro" fi </ins> # Run containers as privileged as it should give them access to some more # syscalls such as ptrace and whatnot. In the upgrade to LLVM 5.0 it was # discovered that the leak sanitizer apparently needs these syscalls nowadays so

docker cp . checkout:/checkout args="$args --volumes-from checkout" else <del> args="$args --volume $root_dir:/checkout:ro" </del> <ins> args="$args --volume $root_dir:/checkout$SRC_MOUNT_OPTION" </ins> args="$args --volume $objdir:/checkout/obj" args="$args --volume $HOME/.cargo:/cargo" args="$args --volume $HOME/rustsrc:$HOME/rustsrc"

then # Interactive + TTY args="$args -it" <del> command="/bin/bash" </del> <ins> if [ $IS_GIT_SOURCE -eq 1 ]; then command=(/bin/bash -c 'git config --global --add safe.directory /checkout;bash') else command=(/bin/bash) fi </ins> else <del> command="/checkout/src/ci/run.sh" </del> <ins> command=(/checkout/src/ci/run.sh) </ins> fi if [ "$CI" != "" ]; then

--init  --rm  rust-ci  <del> $command </del> <ins> "${command[@]}" </ins> cat $objdir/${SUMMARY_FILE} >> "${GITHUB_STEP_SUMMARY}"