Skip to content

Commit db68e3a

Browse files
hujc7hujc7
authored
Merge branch 'develop' into jichuanh/changelog-allow-dots-in-slug
2 parents ba74fb6 + 58f633c commit db68e3a

85 files changed

Lines changed: 2266 additions & 709 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎.github/actions/run-tests/action.yml‎

Lines changed: 49 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -85,6 +85,7 @@ runs:
8585
local logs_pid=""
8686
local wait_pid=""
8787
local docker_wait_file="/tmp/.docker_exit_${container_name}"
88+
local docker_runtime_dir=""
8889
8990
# Kill the container immediately if the runner is cancelled.
9091
# The GitHub Actions runner can deliver HUP, INT, or TERM on cancellation
@@ -94,6 +95,7 @@ runs:
9495
docker kill '${container_name}' 2>/dev/null || true; \
9596
docker rm -f '${container_name}' 2>/dev/null || true; \
9697
rm -f '${docker_wait_file}'; \
98+
if [ -n \"\$docker_runtime_dir\" ]; then rm -rf \"\$docker_runtime_dir\" 2>/dev/null || true; fi; \
9799
if [ -n \"\$logs_pid\" ]; then kill \"\$logs_pid\" 2>/dev/null || true; fi; \
98100
if [ -n \"\$wait_pid\" ]; then kill \"\$wait_pid\" 2>/dev/null || true; fi; \
99101
exit 130" HUP INT TERM
@@ -180,16 +182,56 @@ runs:
180182
docker_env_vars="$docker_env_vars -e TEST_EXTRA_PIP_PACKAGES"
181183
fi
182184
183-
echo "Docker environment variables: '$docker_env_vars'"
184-
185185
# Volume mount for deps-cache-hit mode: bind-mount the checked-out
186186
# source code over /workspace/isaaclab instead of baking it into the image.
187187
docker_volume_args=""
188+
docker_user_args=""
188189
if [ -n "$volume_mount_source" ]; then
189-
docker_volume_args="-v ${volume_mount_source}:/workspace/isaaclab"
190+
host_uid="$(id -u)"
191+
host_gid="$(id -g)"
192+
host_user="$(id -un)"
193+
# Kit writes generated cache, config, data, and log files outside
194+
# the Isaac Lab source tree. Provide writable runtime storage for
195+
# host-uid test runs, mirroring the compose/singularity mounts.
196+
docker_runtime_dir="$(mktemp -d "${RUNNER_TEMP:-/tmp}/isaaclab-docker-runtime.XXXXXX")"
197+
mkdir -p \
198+
"${docker_runtime_dir}/home/.cache" \
199+
"${docker_runtime_dir}/home/.local/share/ov/data" \
200+
"${docker_runtime_dir}/home/.local/share/ov/pkg" \
201+
"${docker_runtime_dir}/home/.nv/ComputeCache" \
202+
"${docker_runtime_dir}/home/.nvidia-omniverse/config" \
203+
"${docker_runtime_dir}/home/.nvidia-omniverse/logs" \
204+
"${docker_runtime_dir}/home/Documents/Kit/shared" \
205+
"${docker_runtime_dir}/isaac-sim/kit/cache" \
206+
"${docker_runtime_dir}/isaac-sim/kit/data" \
207+
"${docker_runtime_dir}/isaac-sim/kit/logs" \
208+
"${docker_runtime_dir}/isaac-sim/cache" \
209+
"${docker_runtime_dir}/isaac-sim/computecache" \
210+
"${docker_runtime_dir}/isaac-sim/config" \
211+
"${docker_runtime_dir}/isaac-sim/data" \
212+
"${docker_runtime_dir}/isaac-sim/logs" \
213+
"${docker_runtime_dir}/isaac-sim/pkg"
214+
docker_volume_args="\
215+
-v ${volume_mount_source}:/workspace/isaaclab:rw \
216+
-v ${docker_runtime_dir}/home:/tmp/isaaclab-ci-home:rw \
217+
-v ${docker_runtime_dir}/isaac-sim/kit/cache:/isaac-sim/kit/cache:rw \
218+
-v ${docker_runtime_dir}/isaac-sim/kit/data:/isaac-sim/kit/data:rw \
219+
-v ${docker_runtime_dir}/isaac-sim/kit/logs:/isaac-sim/kit/logs:rw \
220+
-v ${docker_runtime_dir}/isaac-sim/cache:/isaac-sim/.cache:rw \
221+
-v ${docker_runtime_dir}/isaac-sim/computecache:/isaac-sim/.nv/ComputeCache:rw \
222+
-v ${docker_runtime_dir}/isaac-sim/config:/isaac-sim/.nvidia-omniverse/config:rw \
223+
-v ${docker_runtime_dir}/isaac-sim/data:/isaac-sim/.local/share/ov/data:rw \
224+
-v ${docker_runtime_dir}/isaac-sim/logs:/isaac-sim/.nvidia-omniverse/logs:rw \
225+
-v ${docker_runtime_dir}/isaac-sim/pkg:/isaac-sim/.local/share/ov/pkg:rw"
226+
docker_user_args="--user ${host_uid}:${host_gid}"
227+
docker_env_vars="$docker_env_vars -e HOME=/tmp/isaaclab-ci-home -e XDG_CACHE_HOME=/tmp/isaaclab-ci-home/.cache -e XDG_DATA_HOME=/tmp/isaaclab-ci-home/.local/share -e USER=${host_user} -e LOGNAME=${host_user}"
190228
echo "🔵 Volume-mounting ${volume_mount_source} >> /workspace/isaaclab"
229+
echo "🔵 Mounting writable Docker runtime storage from ${docker_runtime_dir}"
230+
echo "🔵 Running volume-mounted container as host uid:gid ${host_uid}:${host_gid} (${host_user})"
191231
fi
192232
233+
echo "Docker environment variables: '$docker_env_vars'"
234+
193235
# Run tests in a detached container and follow logs. Running detached
194236
# means the container lifecycle is independent of the shell - if the
195237
# runner kills this step on cancellation, the `if: always()` cleanup
@@ -206,6 +248,7 @@ runs:
206248
--ulimit nofile=65536:65536 \
207249
--ulimit nproc=4096:4096 \
208250
$docker_volume_args \
251+
$docker_user_args \
209252
$docker_env_vars \
210253
$image_tag \
211254
-c "
@@ -318,6 +361,9 @@ runs:
318361
# Clean up container
319362
echo "🔵 Cleaning up Docker container..."
320363
docker rm $container_name 2>/dev/null || echo "🟠 Container cleanup failed, but continuing..."
364+
if [ -n "$docker_runtime_dir" ]; then
365+
rm -rf "$docker_runtime_dir" || echo "🟠 Docker runtime storage cleanup failed, but continuing..."
366+
fi
321367
322368
return $DOCKER_EXIT
323369
}

‎.github/workflows/build.yaml‎

Lines changed: 91 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -101,7 +101,7 @@ jobs:
101101
$'^\\.github/workflows/config\\.yaml$\tBase image config'
102102
$'^\\.github/actions/\tCI actions'
103103
)
104-
triggered_jobs="Docker build + all test-* matrix jobs"
104+
triggered_jobs="Docker build + non-root verify jobs + all test-* matrix jobs"
105105
106106
render_table() {
107107
local files="$1" entry regex desc count sample
@@ -215,6 +215,51 @@ jobs:
215215
dockerfile-path: docker/Dockerfile.base
216216
cache-tag: cache-base
217217

218+
verify-base-non-root:
219+
name: verify-base-non-root
220+
runs-on: [self-hosted, gpu]
221+
timeout-minutes: 30
222+
needs: [build, config]
223+
if: needs.build.result == 'success'
224+
steps:
225+
- name: Checkout Code
226+
uses: actions/checkout@v6
227+
with:
228+
fetch-depth: 1
229+
lfs: true
230+
231+
- name: Pull Base Docker image
232+
uses: ./.github/actions/ecr-build-push-pull
233+
with:
234+
image-tag: ${{ env.CI_IMAGE_TAG }}
235+
isaacsim-base-image: ${{ needs.config.outputs.isaacsim_image_name }}
236+
isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
237+
dockerfile-path: docker/Dockerfile.base
238+
cache-tag: cache-base
239+
240+
- name: Run Dockerfile non-root regression test
241+
shell: bash
242+
run: |
243+
set -euo pipefail
244+
docker run --rm \
245+
-v "$PWD":/workspace/isaaclab \
246+
--entrypoint bash \
247+
"${{ env.CI_IMAGE_TAG }}" \
248+
-lc 'cd /workspace/isaaclab && /isaac-sim/python.sh -m pytest docker/test/test_dockerfile_nonroot.py -q'
249+
250+
- name: Verify Base runtime user is non-root
251+
shell: bash
252+
run: |
253+
set -euo pipefail
254+
runtime_identity="$(docker run --rm --entrypoint bash "${{ env.CI_IMAGE_TAG }}" \
255+
-lc 'printf "%s %s %s\n" "$(id -u)" "$(id -g)" "$(id -un 2>/dev/null || true)"')"
256+
read -r runtime_uid runtime_gid runtime_user <<< "${runtime_identity}"
257+
echo "Base runtime identity: uid=${runtime_uid} gid=${runtime_gid} user=${runtime_user}"
258+
if [ "${runtime_uid}" = "0" ]; then
259+
echo "::error::Base Docker image must not run as root by default."
260+
exit 1
261+
fi
262+
218263
build-curobo:
219264
name: Build cuRobo Docker Image
220265
runs-on: [self-hosted, gpu]
@@ -235,6 +280,51 @@ jobs:
235280
isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
236281
dockerfile-path: docker/Dockerfile.curobo
237282
cache-tag: cache-curobo
283+
284+
verify-curobo-non-root:
285+
name: verify-curobo-non-root
286+
runs-on: [self-hosted, gpu]
287+
timeout-minutes: 30
288+
needs: [build-curobo, config]
289+
if: needs.build-curobo.result == 'success'
290+
steps:
291+
- name: Checkout Code
292+
uses: actions/checkout@v6
293+
with:
294+
fetch-depth: 1
295+
lfs: true
296+
297+
- name: Pull cuRobo Docker image
298+
uses: ./.github/actions/ecr-build-push-pull
299+
with:
300+
image-tag: ${{ env.CI_IMAGE_TAG }}-curobo
301+
isaacsim-base-image: ${{ needs.config.outputs.isaacsim_image_name }}
302+
isaacsim-version: ${{ needs.config.outputs.isaacsim_image_tag }}
303+
dockerfile-path: docker/Dockerfile.curobo
304+
cache-tag: cache-curobo
305+
306+
- name: Run Dockerfile non-root regression test
307+
shell: bash
308+
run: |
309+
set -euo pipefail
310+
docker run --rm \
311+
-v "$PWD":/workspace/isaaclab \
312+
--entrypoint bash \
313+
"${{ env.CI_IMAGE_TAG }}-curobo" \
314+
-lc 'cd /workspace/isaaclab && /isaac-sim/python.sh -m pytest docker/test/test_dockerfile_nonroot.py -q'
315+
316+
- name: Verify cuRobo runtime user is non-root
317+
shell: bash
318+
run: |
319+
set -euo pipefail
320+
runtime_identity="$(docker run --rm --entrypoint bash "${{ env.CI_IMAGE_TAG }}-curobo" \
321+
-lc 'printf "%s %s %s\n" "$(id -u)" "$(id -g)" "$(id -un 2>/dev/null || true)"')"
322+
read -r runtime_uid runtime_gid runtime_user <<< "${runtime_identity}"
323+
echo "cuRobo runtime identity: uid=${runtime_uid} gid=${runtime_gid} user=${runtime_user}"
324+
if [ "${runtime_uid}" = "0" ]; then
325+
echo "::error::cuRobo Docker image must not run as root by default."
326+
exit 1
327+
fi
238328
#endregion
239329

240330
#region test jobs

‎CONTRIBUTORS.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -80,6 +80,7 @@ Guidelines for modifications:
8080
* Emily Sturman
8181
* Emmanuel Ferdman
8282
* Fabian Jenelten
83+
* Fatima Anes
8384
* Felipe Mohr
8485
* Felix Yu
8586
* Frank Lai

‎docker/.env.base‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ ISAACSIM_VERSION=6.0.0-dev2
1313
DOCKER_ISAACSIM_ROOT_PATH=/isaac-sim
1414
# The Isaac Lab path in the container
1515
DOCKER_ISAACLAB_PATH=/workspace/isaaclab
16-
# Docker user directory - by default this is the root user's home directory
16+
# Docker runtime user directory
1717
DOCKER_USER_HOME=/root
1818
# Docker image and container name suffix (default "", set by the container_interface.py script)
1919
# Example: "-custom"

‎docker/Dockerfile.base‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
#
44
# SPDX-License-Identifier: BSD-3-Clause
55

6-
# Nvidia Dockerfiles: https://github.com/NVIDIA-Omniverse/IsaacSim-dockerfiles
7-
# Please check above link for license information.
6+
# Isaac Sim base container: https://catalog.ngc.nvidia.com/orgs/nvidia/containers/isaac-sim
7+
# Please check the NGC container page for license information.
88

99
# Base image
1010
ARG ISAACSIM_BASE_IMAGE_ARG
@@ -26,14 +26,17 @@ ENV ISAACSIM_ROOT_PATH=${ISAACSIM_ROOT_PATH_ARG}
2626
# Path to the Isaac Lab directory
2727
ARG ISAACLAB_PATH_ARG
2828
ENV ISAACLAB_PATH=${ISAACLAB_PATH_ARG}
29-
# Home dir of docker user, typically '/root'
29+
# Home dir of the runtime docker user, typically '/root'
3030
ARG DOCKER_USER_HOME_ARG
3131
ENV DOCKER_USER_HOME=${DOCKER_USER_HOME_ARG}
32+
ENV HOME=${DOCKER_USER_HOME}
3233

3334
# Set environment variables
3435
ENV LANG=C.UTF-8
3536
ENV DEBIAN_FRONTEND=noninteractive
3637

38+
# Base image may end with a non-root user; switch to root for system-level
39+
# setup and package installation.
3740
USER root
3841

3942
# Install dependencies
@@ -121,19 +124,40 @@ RUN --mount=type=cache,target=${DOCKER_USER_HOME}/.cache/pip \
121124
RUN ${ISAACLAB_PATH}/isaaclab.sh -p -m pip uninstall -y quadprog
122125

123126
# aliasing isaaclab.sh and python for convenience
124-
RUN echo "export ISAACLAB_PATH=${ISAACLAB_PATH}" >> ${HOME}/.bashrc && \
125-
echo "alias isaaclab=${ISAACLAB_PATH}/isaaclab.sh" >> ${HOME}/.bashrc && \
126-
echo "alias python=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${HOME}/.bashrc && \
127-
echo "alias python3=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${HOME}/.bashrc && \
128-
echo "alias pip='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${HOME}/.bashrc && \
129-
echo "alias pip3='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${HOME}/.bashrc && \
130-
echo "alias tensorboard='${ISAACLAB_PATH}/_isaac_sim/python.sh ${ISAACLAB_PATH}/_isaac_sim/tensorboard'" >> ${HOME}/.bashrc && \
131-
echo "export TZ=$(date +%Z)" >> ${HOME}/.bashrc && \
132-
echo "shopt -s histappend" >> /root/.bashrc && \
133-
echo "PROMPT_COMMAND='history -a'" >> /root/.bashrc
127+
RUN echo "export ISAACLAB_PATH=${ISAACLAB_PATH}" >> ${DOCKER_USER_HOME}/.bashrc && \
128+
echo "alias isaaclab=${ISAACLAB_PATH}/isaaclab.sh" >> ${DOCKER_USER_HOME}/.bashrc && \
129+
echo "alias python=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${DOCKER_USER_HOME}/.bashrc && \
130+
echo "alias python3=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${DOCKER_USER_HOME}/.bashrc && \
131+
echo "alias pip='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${DOCKER_USER_HOME}/.bashrc && \
132+
echo "alias pip3='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${DOCKER_USER_HOME}/.bashrc && \
133+
echo "alias tensorboard='${ISAACLAB_PATH}/_isaac_sim/python.sh ${ISAACLAB_PATH}/_isaac_sim/tensorboard'" >> ${DOCKER_USER_HOME}/.bashrc && \
134+
echo "export TZ=$(date +%Z)" >> ${DOCKER_USER_HOME}/.bashrc && \
135+
echo "shopt -s histappend" >> ${DOCKER_USER_HOME}/.bashrc && \
136+
echo "PROMPT_COMMAND='history -a'" >> ${DOCKER_USER_HOME}/.bashrc
137+
138+
# Create the non-root runtime user after root-only image setup is complete.
139+
# The uid/gid 1000 match GitHub runner bind mounts used by Docker tests.
140+
# --non-unique is required because some base image revisions already carry
141+
# another user or group at uid/gid 1000.
142+
RUN groupadd --non-unique --gid 1000 isaaclab \
143+
&& useradd --non-unique --uid 1000 --gid 1000 -M -l -s /bin/bash -d ${DOCKER_USER_HOME} isaaclab
144+
145+
RUN chown -R isaaclab:isaaclab \
146+
${ISAACLAB_PATH} \
147+
${DOCKER_USER_HOME}
148+
149+
# Open up traversal of the Isaac Sim root and runtime home for non-root users.
150+
# Inner Isaac Sim files keep their original permissions, so avoid chowning the
151+
# full install. Keep the runtime home closed to unrelated users.
152+
RUN chmod 755 \
153+
${ISAACSIM_ROOT_PATH} \
154+
&& chmod 750 \
155+
${DOCKER_USER_HOME}
134156

135157
# copy the rest of the files
136-
COPY ../ ${ISAACLAB_PATH}/
158+
COPY --chown=isaaclab:isaaclab ../ ${ISAACLAB_PATH}/
159+
160+
USER isaaclab
137161

138162
# make working directory as the Isaac Lab directory
139163
# this is the default directory when the container is run

‎docker/Dockerfile.curobo‎

Lines changed: 38 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@
33
#
44
# SPDX-License-Identifier: BSD-3-Clause
55

6-
# Nvidia Dockerfiles: https://github.com/NVIDIA-Omniverse/IsaacSim-dockerfiles
7-
# Please check above link for license information.
6+
# Isaac Sim base container: https://catalog.ngc.nvidia.com/orgs/nvidia/containers/isaac-sim
7+
# Please check the NGC container page for license information.
88

99
# Base image
1010
ARG ISAACSIM_BASE_IMAGE_ARG
@@ -26,14 +26,17 @@ ENV ISAACSIM_ROOT_PATH=${ISAACSIM_ROOT_PATH_ARG}
2626
# Path to the Isaac Lab directory
2727
ARG ISAACLAB_PATH_ARG
2828
ENV ISAACLAB_PATH=${ISAACLAB_PATH_ARG}
29-
# Home dir of docker user, typically '/root'
29+
# Home dir of the runtime docker user, typically '/root'
3030
ARG DOCKER_USER_HOME_ARG
3131
ENV DOCKER_USER_HOME=${DOCKER_USER_HOME_ARG}
32+
ENV HOME=${DOCKER_USER_HOME}
3233

3334
# Set environment variables
3435
ENV LANG=C.UTF-8
3536
ENV DEBIAN_FRONTEND=noninteractive
3637

38+
# Base image may end with a non-root user; switch to root for system-level
39+
# setup and package installation.
3740
USER root
3841

3942
# Install dependencies
@@ -176,19 +179,40 @@ RUN ${ISAACLAB_PATH}/isaaclab.sh -p -m pip install --no-build-isolation \
176179
RUN ${ISAACLAB_PATH}/isaaclab.sh -p -m pip install --editable ${ISAACLAB_PATH}/source/isaaclab_teleop
177180

178181
# aliasing isaaclab.sh and python for convenience
179-
RUN echo "export ISAACLAB_PATH=${ISAACLAB_PATH}" >> ${HOME}/.bashrc && \
180-
echo "alias isaaclab=${ISAACLAB_PATH}/isaaclab.sh" >> ${HOME}/.bashrc && \
181-
echo "alias python=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${HOME}/.bashrc && \
182-
echo "alias python3=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${HOME}/.bashrc && \
183-
echo "alias pip='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${HOME}/.bashrc && \
184-
echo "alias pip3='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${HOME}/.bashrc && \
185-
echo "alias tensorboard='${ISAACLAB_PATH}/_isaac_sim/python.sh ${ISAACLAB_PATH}/_isaac_sim/tensorboard'" >> ${HOME}/.bashrc && \
186-
echo "export TZ=$(date +%Z)" >> ${HOME}/.bashrc && \
187-
echo "shopt -s histappend" >> /root/.bashrc && \
188-
echo "PROMPT_COMMAND='history -a'" >> /root/.bashrc
182+
RUN echo "export ISAACLAB_PATH=${ISAACLAB_PATH}" >> ${DOCKER_USER_HOME}/.bashrc && \
183+
echo "alias isaaclab=${ISAACLAB_PATH}/isaaclab.sh" >> ${DOCKER_USER_HOME}/.bashrc && \
184+
echo "alias python=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${DOCKER_USER_HOME}/.bashrc && \
185+
echo "alias python3=${ISAACLAB_PATH}/_isaac_sim/python.sh" >> ${DOCKER_USER_HOME}/.bashrc && \
186+
echo "alias pip='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${DOCKER_USER_HOME}/.bashrc && \
187+
echo "alias pip3='${ISAACLAB_PATH}/_isaac_sim/python.sh -m pip'" >> ${DOCKER_USER_HOME}/.bashrc && \
188+
echo "alias tensorboard='${ISAACLAB_PATH}/_isaac_sim/python.sh ${ISAACLAB_PATH}/_isaac_sim/tensorboard'" >> ${DOCKER_USER_HOME}/.bashrc && \
189+
echo "export TZ=$(date +%Z)" >> ${DOCKER_USER_HOME}/.bashrc && \
190+
echo "shopt -s histappend" >> ${DOCKER_USER_HOME}/.bashrc && \
191+
echo "PROMPT_COMMAND='history -a'" >> ${DOCKER_USER_HOME}/.bashrc
192+
193+
# Create the non-root runtime user after root-only image setup is complete.
194+
# The uid/gid 1000 match GitHub runner bind mounts used by the cuRobo tests.
195+
# --non-unique is required because some base image revisions already carry
196+
# another user or group at uid/gid 1000.
197+
RUN groupadd --non-unique --gid 1000 isaaclab \
198+
&& useradd --non-unique --uid 1000 --gid 1000 -M -l -s /bin/bash -d ${DOCKER_USER_HOME} isaaclab
199+
200+
RUN chown -R isaaclab:isaaclab \
201+
${ISAACLAB_PATH} \
202+
${DOCKER_USER_HOME}
203+
204+
# Open up traversal of the Isaac Sim root and runtime home for non-root users.
205+
# Inner Isaac Sim files keep their original permissions, so avoid chowning the
206+
# full install. Keep the runtime home closed to unrelated users.
207+
RUN chmod 755 \
208+
${ISAACSIM_ROOT_PATH} \
209+
&& chmod 750 \
210+
${DOCKER_USER_HOME}
189211

190212
# copy the rest of the files
191-
COPY ../ ${ISAACLAB_PATH}/
213+
COPY --chown=isaaclab:isaaclab ../ ${ISAACLAB_PATH}/
214+
215+
USER isaaclab
192216

193217
# make working directory as the Isaac Lab directory
194218
# this is the default directory when the container is run

0 commit comments

Comments
 (0)