Docker UEFI build cannot write to mounted folders in host system.

[david0sen]

The docker user edk2 in the image ghcr.io/tianocore/containers/ubuntu-22-dev:latest cannot write to mounted folders from the host system.

The edk2_docker init_edkrepo_conf fails with: cp: cannot create directory '/home/david.fernandez/.edkrepo': Permission denied

$ edk2_docker.sh whoami
edk2

[jgarver]

Can you try this and pass along what you see?

$ id
$ edk2_docker id

They should match up. For example, in my case:

$ id
uid=1002(jake) gid=1002(localusers) groups=1002(localusers),27(sudo),120(docker)
$ edk2_docker id
uid=1002(edk2) gid=1002(edk2) groups=1002(edk2),27(sudo)

There's an entry point in the docker image that creates the edk2 user and configures it with the same uid and gid as the launching user. It uses the launching user's home directory to harvest the uid and gid.

[david0sen]

Here you are:

$ id
uid=1000(david.fernandez) gid=1000(david.fernandez) groups=1000(david.fernandez),0(root),10(wheel),18(dialout),36(kvm),107(qemu),955(docker),964(wireshark),970(vboxusers),976(vboxsf),981(nm-openvpn),982(openvpn) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

$ edk2_docker id
uid=1000(edk2) gid=1000(edk2) groups=1000(edk2),27(sudo)

I wonder if selinux or other stuff might have something to do with it...

[jgarver]

Looks like you have selinux constraints.
context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023

I suspect that's what's keeping you from access your home directory from inside the container. You probably need to relax your selinux constraints. Honestly, I have no experience with this, so I'm not sure how to go about doing that.

You could also abandon our recipe and use the container differently. Instead of your real home directory, you could map in another directory that selinux allows you to use. Or you could run persistently and not try to access files outside of the container (you'd need a way to transfer the build results out, though).

[david0sen]

Or you could run persistently and not try to access files outside of the container (you'd need a way to transfer the build results out, though).

Yes, I thought of that...

Rightm, I guess I'll have to ask around somewhere, as my experience with selinux or docker is limited.

[david0sen]

Funny, now that I added selinux to the search, I got this:
https://stackoverflow.com/questions/24288616/permission-denied-on-accessing-host-directory-in-docker

• Adding --privileged=true seems to be the quick-and-dirty way.
• Also adding --security-opt label:disable works.
• Appending :Z to the mount spec also works.