#geodesic (2022-08)

@Jeremy G (Cloud Posse)

@Jeremy G (Cloud Posse) friendly ping on this.

We’re installing golang in our toolbox Containerfile and then we’d like to make sure that it is in the PATH. When we set the PATH in the Containerfile, it gets overwritten so we haven’t been able to accomplish it that way. So right now, we’re doing this by using an overrides file locally on the host machine, but that doesn’t scale with many team members.

To skip over digging deep into the internals of the Geodesic bash-fu, we figured you’d have a solution for us. Any thoughts?

Replacement for /etc/profile. Add it to your repo as rootfs/etc/profile

Sorry I missed the first mention of this (I blame Slack).

This is not Geodesic’s doing. The issue is that PATH is explicitly set under Debian via /etc/profile. Every time a bash shell starts, the PATH gets reset rather than inherited. This is likely due to Debian’s orientation as a more secure Linux for running servers, in that blocks a lot of attack vectors that rely on swapping out executables by rewriting PATH.

The only fix is to replace Debian’s /etc/profile with one that does not change the PATH, but that could be a subtle breaking change and I am reluctant to overwrite system files like that in the base Geodesic. Among other reasons are that this will obscure and revert any future changes made by Debian and it will break the default expected (secure) behavior of Debian.

You can, of course, do it yourself. Just add the /etc/profile replacement I posted just before this to your Docker context as rootfs/etc/profile and ensure your Dockerfile has the Geodesic standard line

COPY rootfs/ /

@Joe Niland No, I don’t think there is a better way than using overrides.d; this is the kind of thing that was designed for. Unless you mean you want everyone using the image to get it, in which case I would advise you to do what I advised @Matt Gowie to do above, which is set the PATH in the Dockerfile and replace /etc/profile with something that does not reset it.

@Jeremy G (Cloud Posse) overriding /etc/profile looks great. That was what we were looking for. Thanks for that.

We also can use RUN to just append our PATH addition to the end of that file, which I also like so we’re not undoing Debian’s default of clearing the PATH. We’ll likely go that route.

cc @Joe Niland

@Jeremy G (Cloud Posse) thanks very much for the clarification. I didn’t realise that was the case with Debian. Yes, the question arose because we want to make it a standard ‘feature’ of this custom Geodesic image.

@Matt Gowie @Joe Niland I’m preparing a PR that will set the PATH the way Alpine does, among other things. That is, it appends to the inherited path rather than reseting it.

Sounds great! Thank you

Awesome — Thanks Jeremy

This should do it. Please review and LMK what you think. https://github.com/cloudposse/geodesic/pull/801

@Joe Niland @Matt Gowie You can try it out by using

FROM cloudposse/geodesic:pr-801-debian

LMK how it goes.

Thanks @Jeremy G (Cloud Posse) will do this ASAP

@Matt Gowie Any feedback before I publish this?

Nope — It looks like it works great. Thanks for the extremely speedy turnaround — Love to see it!

Geodesic version 1.3.0 has been published. Docker image should be available in about 20 minutes.

@Erik Osterman (Cloud Posse)

Thanks again @Jeremy G (Cloud Posse) (I left brief test details in the PR comments in case anyone else is following this thread)