CLDSRV-1050: Keep the federation image home dir traversable by any uid

.github/workflows/tests.yaml

@@ -272,6 +272,14 @@ jobs:
           cache-from: type=gha,scope=federation
           cache-to: type=gha,mode=max,scope=federation
 
+      # Federation runs the container as the host user, not as the image user
+      - name: Check the federation image entry point is readable by another uid
+        run: >-
+          docker run --rm --user 490:490 --entrypoint bash
+          ghcr.io/${{ github.repository }}:${{ github.sha }}-federation
+          -c 'cd /home/scality/s3 && [[ -r index.js ]] ||
+          { echo "index.js not readable by uid $(id -u)"; exit 1; }'
+
       - name: Build and push pykmip image
         uses: docker/build-push-action@v5
         with:

images/federation/Dockerfile

@@ -19,7 +19,10 @@ ENV HOME_DIR="/home/${USER}" \
     DATA_DIR="/data" \
     SUP_RUN_DIR="/var/run/supervisor"
 
-RUN mv /home/node ${HOME_DIR} && usermod --login ${USER} --shell /bin/bash -d ${HOME_DIR} node
+# Federation runs the container as the host user, not as ${USER}, so the home
+# dir must stay traversable (the trixie node image creates /home/node as 700)
+RUN mv /home/node ${HOME_DIR} && chmod 755 ${HOME_DIR} && \
+    usermod --login ${USER} --shell /bin/bash -d ${HOME_DIR} node
 RUN mkdir ${LOG_DIR} && chown ${USER} ${LOG_DIR} && \
     mkdir ${CONF_DIR} && chown ${USER} ${CONF_DIR} && \
     mkdir ${DATA_DIR} && chown ${USER} ${DATA_DIR} && \

package.json

@@ -1,6 +1,6 @@
 {
     "name": "@scality/cloudserver",
-    "version": "9.5.0",
+    "version": "9.5.1",
     "description": "Zenko CloudServer, an open-source Node.js implementation of a server handling the Amazon S3 protocol",
     "main": "index.js",
     "engines": {