Skip to content

fix: Add USER id and writable HOME fallbacks to Dockerfile ENTRYPOINT#46

Draft
matthewfeickert wants to merge 1 commit into
CHTC:masterfrom
matthewfeickert:fix/harden-dockerfile
Draft

fix: Add USER id and writable HOME fallbacks to Dockerfile ENTRYPOINT#46
matthewfeickert wants to merge 1 commit into
CHTC:masterfrom
matthewfeickert:fix/harden-dockerfile

Conversation

@matthewfeickert

@matthewfeickert matthewfeickert commented Jul 4, 2026

Copy link
Copy Markdown
Contributor

HTCondor's container universe runs Docker images as the execute node's slot uid, which has no /etc/passwd entry inside the container, and with a scrubbed environment (no USER or LOGNAME set). Python's getpass.getuser() then raises "OSError: No username set in the environment", aborting 'import torchvision' when torch._inductor resolves its cache directory (/tmp/torchinductor_<username>) at import time.

Export fallback USER and LOGNAME (the numeric uid) in the generated entrypoint.sh used for the Docker container images' ENTRYPOINT so getpass.getuser() resolves from the environment without needing the passwd database, and fall back to a writable temporary directory when HOME is unset or unwritable (Docker sets HOME=/ for unknown uids), protecting workloads that write to ~/.cache (torch hub, matplotlib, fontconfig).

Apptainer images are unaffected: Apptainer injects the invoking user's passwd entry into the container at startup ('config passwd = yes' default in apptainer.conf), so apptainer.def needs no change.


Should go in before PR #43

HTCondor's container universe runs Docker images as the execute node's
slot uid, which has no /etc/passwd entry inside the container, and with
a scrubbed environment (no USER or LOGNAME set). Python's
getpass.getuser() then raises "OSError: No username set in the
environment", aborting 'import torchvision' when torch._inductor
resolves its cache directory (/tmp/torchinductor_<username>) at import
time.

Export fallback USER and LOGNAME (the numeric uid) in the generated
entrypoint.sh so getpass.getuser() resolves from the environment without
needing the passwd database, and fall back to a writable temporary
directory when HOME is unset or unwritable (Docker sets HOME=/ for
unknown uids), protecting workloads that write to ~/.cache (torch hub,
matplotlib, fontconfig).

Apptainer images are unaffected: Apptainer injects the invoking user's
passwd entry into the container at startup ('config passwd = yes'
default in apptainer.conf), so apptainer.def needs no change.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant