panic: couldn't get username

[ghuls]

With the latest version (0.3.2), for different images the following error appears now: panic: couldn't get username

$ ./dockerc --image docker://oven/bun --output bun

$ ./bun 
thread 40341 panic: couldn't get username
Unwind error at address `exe:0x1083476` (error.InvalidDebugInfo), trace may be incomplete

Aborted (core dumped)

$ ./dockerc -i docker://bash:latest -o bash

$ ./bash
thread 40682 panic: couldn't get username
Unwind error at address `exe:0x1083476` (error.InvalidDebugInfo), trace may be incomplete

Aborted (core dumped)

[NilsIrl]

Could you give more details about the system you're running this on? What happens when you run id?

[ghuls]

$ cat /etc/lsb-release 
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.6 LTS"

$ id
uid=664378338(u0078912) gid=664200513(domain users) groups=664200513(domain users),27(sudo),140(docker)

And on Rocky Linux 8.9:

❯ cat /etc/os-release 
NAME="Rocky Linux"
VERSION="8.9 (Green Obsidian)"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="8.9"
PLATFORM_ID="platform:el8"
PRETTY_NAME="Rocky Linux 8.9 (Green Obsidian)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:8:GA"
HOME_URL="https://rockylinux.org/"
BUG_REPORT_URL="https://bugs.rockylinux.org/"
SUPPORT_END="2029-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-8"
ROCKY_SUPPORT_PRODUCT_VERSION="8.9"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="8.9

$ ./dockerc --image docker://oven/bun --output bun
FATA[0000] initializing source docker://oven/bun:latest: getting username and password: 1 error occurred:
        * reading JSON file "/run/containers/2530366/auth.json": open /run/containers/2530366/auth.json: permission denied
 
   ⨯ open CAS: validate: read oci-layout: invalid image detected
Cannot stat source directory "/tmp/dockerc-5wU8DN/bundle" because No such file or directory

$ ./dockerc -i docker://bash:latest -o bash
FATA[0000] initializing source docker://bash:latest: getting username and password: 1 error occurred:
        * reading JSON file "/run/containers/2530366/auth.json": open /run/containers/2530366/auth.json: permission denied
 
   ⨯ open CAS: validate: read oci-layout: invalid image detected
Cannot stat source directory "/tmp/dockerc-2h07cW/bundle" because No such file or directory

[NilsIrl]

How did you create your user? if you look at /etc/passwd, is there a username associated with your user there?

[ghuls]

No, it is not in /etc/passwd as this computer is in a domain and multiple users can login on this PC (LAPS).

[ghuls]

$ cat getpwuid.c
#include <pwd.h>
#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>
#include <errno.h>

int
main(int argc, char *argv[])
{
    struct passwd pwd;
    struct passwd *result;
    char *buf;
    size_t bufsize;
    int s;

   if (argc != 2) {
        fprintf(stderr, "Usage: %s username\n", argv[0]);
        exit(EXIT_FAILURE);
    }

   bufsize = sysconf(_SC_GETPW_R_SIZE_MAX);
    if (bufsize == -1)          /* Value was indeterminate */
        bufsize = 16384;        /* Should be more than enough */

   buf = malloc(bufsize);
    if (buf == NULL) {
        perror("malloc");
        exit(EXIT_FAILURE);
    }

   s = getpwuid_r(atol(argv[1]), &pwd, buf, bufsize, &result);
    if (result == NULL) {
        if (s == 0)
            printf("Not found\n");
        else {
            errno = s;
            perror("getpwuid_r");
        }
        exit(EXIT_FAILURE);
    }
   printf("Name: %s; UID: %ld\n", pwd.pw_gecos, (long) pwd.pw_uid);

    exit(EXIT_SUCCESS);
}

$ gcc -o getpwuid getpwuid.c

$ ./getpwuid 664378338
Name: u0078912; UID: 664378338

[ghuls]

I assume getpwuid of musl does not support it like glibc does.

In case getpwuid fails, calling one of the following binaries could be an alternative, besides a glibc build of dockerc:

$ whoami
u0078912

$ id -un
u0078912

https://unix.stackexchange.com/questions/76354/who-sets-user-and-username-environment-variables

[NilsIrl]

Thank you very much for figuring this out. I have added a glibc based binary (dockerc_x86-64-gnu) to the latest release as a temporary fix, hopefully something better can be figured out in the future.

[ghuls]

Could you compile against an old glibc, like glibc 2.28 (CentOS 8), so it works on most distributions?

zig build -Doptimize=ReleaseSafe -Dtarget=x86_64-linux-gnu.2.28

[NilsIrl]

updated the binary in the release

[ghuls]

Thanks. It works now on Ubuntu 20.04. On Rocky 8.9 it also goes past this error, but hits another one.

$ ./dockerc_x86-64-gnu -i docker://docker.io/library/bash:latest -o bash
FATA[0000] initializing source docker://bash:latest: getting username and password: 1 error occurred:
	* reading JSON file "/run/containers/2530366/auth.json": open /run/containers/2530366/auth.json: permission denied
 
   ⨯ open CAS: validate: read oci-layout: invalid image detected
Cannot stat source directory "/tmp/dockerc-bKubS6/bundle" because No such file or directory

Somehow it fails to login to docker. Logging it manually with docker login docker.io (which would call podman on this node) and rerunning dockerc does not help.

[ghuls]

I figured out a workaround by using XDG_RUNTIME_DIR:
containers/image#1097

XDG_RUNTIME_DIR=/tmp/podman-run-$(id -u) ./dockerc_x86-64-gnu -i docker://bash:latest -o bash
Getting image source signatures
Copying blob c6a83fedfae6 done   | 
Copying blob 70acf8f93de9 done   | 
Copying blob 7621ec80326e done   | 
Copying config bd4206c5bc done   | 
Writing manifest to image destination
Parallel mksquashfs: Using 48 processors
Creating 4.0 filesystem on bash, block size 131072.
[======================================================================================================================================================================================================================================|] 328/328 100%

Exportable Squashfs 4.0 filesystem, zstd compressed, data block size 131072
        compressed data, compressed metadata, compressed fragments,
        no xattrs, compressed ids
        duplicates are removed
Filesystem size 5600.08 Kbytes (5.47 Mbytes)
        39.59% of uncompressed filesystem size (14146.67 Kbytes)
Inode table size 4608 bytes (4.50 Kbytes)
        18.54% of uncompressed inode table size (24854 bytes)
Directory table size 6605 bytes (6.45 Kbytes)
        50.55% of uncompressed directory table size (13067 bytes)
Number of duplicate files found 8
Number of inodes 695
Number of files 240
Number of fragments 21
Number of symbolic links 336
Number of device nodes 0
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 119
Number of hard-links 1
Number of ids (unique uids + gids) 1
Number of uids 1
        root (0)
Number of gids 1
        root (0)

Even if the dir does not exists, it seems to work:

XDG_RUNTIME_DIR=/tmp/podman-run-$(id -u) ./dockerc_x86-64-gnu -i docker://bash:latest -o bash
WARN[0000] "/tmp/podman-run-2530366" directory set by $XDG_RUNTIME_DIR does not exist. Either create the directory or unset $XDG_RUNTIME_DIR.: stat /tmp/podman-run-2530366: no such file or directory: Trying to pull image in the event that it is a public image. 
Getting image source signatures
Copying blob 7621ec80326e done   | 
Copying blob 70acf8f93de9 done   | 
Copying blob c6a83fedfae6 done   | 
Copying config bd4206c5bc done   | 
Writing manifest to image destination
Parallel mksquashfs: Using 36 processors
Creating 4.0 filesystem on bash, block size 131072.
[======================================================================================================================================================================================================================================|] 328/328 100%

Exportable Squashfs 4.0 filesystem, zstd compressed, data block size 131072
	compressed data, compressed metadata, compressed fragments,
	no xattrs, compressed ids
	duplicates are removed
Filesystem size 5600.23 Kbytes (5.47 Mbytes)
	39.59% of uncompressed filesystem size (14146.46 Kbytes)
Inode table size 4608 bytes (4.50 Kbytes)
	18.54% of uncompressed inode table size (24854 bytes)
Directory table size 6605 bytes (6.45 Kbytes)
	50.55% of uncompressed directory table size (13067 bytes)
Number of duplicate files found 8
Number of inodes 695
Number of files 240
Number of fragments 21
Number of symbolic links 336
Number of device nodes 0
Number of fifo nodes 0
Number of socket nodes 0
Number of directories 119
Number of hard-links 1
Number of ids (unique uids + gids) 1
Number of uids 1
	root (0)
Number of gids 1
	root (0)

Not sure how exactly it works in cases where the specified dir does not actually contain the credentials:

$ XDG_RUNTIME_DIR=/tmp/podman-run-$(id -u) /tmp/dockerc-ydTLti/skopeo login docker.io
Authenticating with existing credentials for docker.io
Existing credentials are valid. Already logged in to docker.io

$ XDG_RUNTIME_DIR=/tmp /tmp/dockerc-ydTLti/skopeo login docker.io
Authenticating with existing credentials for docker.io
Existing credentials are valid. Already logged in to docker.io

$ XDG_RUNTIME_DIR="" /tmp/dockerc-ydTLti/skopeo login docker.io
FATA[0000] get credentials: 1 error occurred:
        * reading JSON file "/run/containers/2530366/auth.json": open /run/containers/2530366/auth.json: permission denied
 
$ XDG_RUNTIME_DIR="/" /tmp/dockerc-ydTLti/skopeo login docker.io
Authenticating with existing credentials for docker.io
Existing credentials are valid. Already logged in to docker.io