vendor: switch from idtools to moby/sys/user #5791
Conversation
github-actions
bot
added
area/dependencies
jsternberg
force-pushed
the
moby-sys-user
branch
from
8cd06e5 to
c5768b4
Compare
Convert usages of `github.com/docker/docker/pkg/idtools` to `github.com/moby/sys/user` in order to break the dependency between buildkit and docker. Signed-off-by: Jonathan A. Sternberg <[email protected]>
jsternberg
force-pushed
the
moby-sys-user
branch
from
c5768b4 to
1ba5aa4
Compare
| ContainerAdministratorSidString = "S-1-5-93-2-1" | ||
| ContainerUserSidString = "S-1-5-93-2-2" |
There was a problem hiding this comment.
I guess we need them because they were not ported to moby/sys? https://github.com/moby/moby/blob/7194b508b6766a372e42156bb3314288bd7fbd0c/pkg/idtools/idtools_windows.go#L11-L16.
@thaJeztah Is moby/sys not a good place in the meantime while waiting for a better place like hcsshim? (cc @gabriel-samfira @profnandaa @TBBle)
There was a problem hiding this comment.
Yes, we need a place for this ultimately. To my understanding (but hoping some of the Microsoft folks can confirm), these SIDs (and the related name) are "special" as they are ones that are available by default in containers.
What I don't know though, is where is that documented ? They were introduced in Moby during the implementation of container support for Windows; if they are to be considered special, then they could use an official definition; e.g. to be documented as part of the OCI specifications, and possibly the OCI could define them as consts (for convenience).
There was a problem hiding this comment.
I think this is when the consts where introduced moby/moby#35521 (comment), but not sure where they originated from and/or if there's a definition elsewhere;
moby/moby#35521 (comment) also had this part;
sddlString := system.SddlAdministratorsLocalSystem
sddlString += "(A;OICI;GRGWGXRCWDSD;;;" + identity.SID + ")"
``
Convert usages of
github.com/docker/docker/pkg/idtoolstojackfan.us.kg/moby/sys/userin order to break the dependency betweenbuildkit and docker.