Fix license file activation for non-root containers#107
Open
bschwedler wants to merge 18 commits into
Open
Conversation
Adds RHEL 10 (amd64 + arm64) to the latest release version (2026.05.0) and both dev streams (preview, daily). Templates and rendered files follow in subsequent commits.
dnf-based equivalent of the Ubuntu install script. Installs the rstudio-pm RPM package from the Posit Pro Cloudsmith repo (already configured by dnf.run_setup() in the Containerfile) and writes the same R/Python config to rstudio-pm.gcfg as the Ubuntu variant.
Mirrors the ubuntu-24.04 structure: python builder stage, dnf setup, package install, Python + R (Standard only), PPM install script, startup.sh. Uses registry.access.redhat.com/ubi10/ubi as base.
The RHEL 10 RPM assigns uid=998/gid=997 to the rstudio-pm user, while the Ubuntu .deb uses uid=999/gid=999. Hard-coding 999 caused three failures in the RHEL 10 Minimal dgoss run. Use goss Go template conditionals on IMAGE_OS_FAMILY at test runtime to select the correct expected values per OS family.
Avoid floating latest tag; 10.2 is the current RHEL 10 minor release, equivalent to the ubuntu:24.04 pin used on Ubuntu Containerfiles.
Equivalent to ubuntu:24.04 floating within the LTS release stream. Add a comment explaining the intent to prevent future "fixing" to a pinned minor version. Reverts 8ba4cab.
Add a notification step to the CI job, conditioned on merge_group events, so that merge queue failures trigger a Slack alert. Adds an id to the alls-green step so its outcome is referenceable.
Without this trigger, the workflow never runs on merge_group events, so the github.event_name == 'merge_group' condition in the Slack notification step was never satisfied — effectively dead code.
Replace `license-manager activate-file --userspace` with a direct file copy to `/home/rstudio-pm/.rstudio-pm/license.lic`. The `activate-file` command requires root even with `--userspace`, crashing the container when it runs as a non-root user. The container already runs as `USER rstudio-pm` via the Containerfile, so no `chown` is needed after the copy. A mktemp guard is used before any cleanup so the source file is safely read even if `PPM_LICENSE_FILE_PATH` points inside the target directory. Mirrors the fix applied to rstudio-docker-products in July 2025 (commit 66470dc), minus the `chown` that was needed in that image because it ran as root.
bschwedler
requested review from
CDRayn,
ianpittwood and
jmwoliver
as code owners
Switch the copy destination from the userspace home path to /var/lib/rstudio-pm, which is the path defined in the product docs and matches the native scan location. Add a comment explaining why direct copy is used instead of activate-file.
If PPM_LICENSE_FILE_PATH already points to the destination (/var/lib/rstudio-pm/license.lic), skip the copy entirely. This avoids a redundant write when the license is pre-placed via a subPath volume mount directly into the data directory. Also removes the rm -f /var/lib/rstudio-pm/*.lic glob that preceded the copy. Blanket-removing all *.lic files is destructive to any pre-placed files in that directory. With the copy writing to a fixed filename (license.lic), the rm is unnecessary. Removes the mktemp intermediate since it was only needed to guard the source file from the rm -f step.
- Add echo to each license activation branch (key, server, file) - Replace specific filename equality check with dirname check so any *.lic file already inside /var/lib/rstudio-pm/ is treated as pre-placed (docs mandate no specific filename) - Extract _license_dir variable to avoid repeating the path - Clean up detected-file log messages (drop the glob from the message)
The /home/rstudio-pm/.rstudio-pm/ fallback was a remnant of the activate-file --userspace era. Users who had license files there should migrate to /var/lib/rstudio-pm/ or use PPM_LICENSE_FILE_PATH.
Writing a license file into a mounted volume pollutes shared persistent storage and causes race conditions in multi-pod deployments. Fail loudly with a clear error instead, directing users to mount the license Secret directly into the data directory via subPath.
Remove echo before license-manager key/server activation — silent success is fine, the failure from license-manager itself is the signal. Redirect remaining file-based license messages to stderr so they surface correctly in log aggregators and don't pollute stdout.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Replace
license-manager activate-file --userspacewith a direct filecopy to
/home/rstudio-pm/.rstudio-pm/license.lic, where PackageManager reads
*.licfiles natively.Copying the license file directly is the approach recommended by the
product teams. It avoids the activation/deactivation cycle entirely,
eliminating the risk of leaking activation slots when a container exits
ungracefully. An alternative would be to keep
activate-file --userspace(which was introduced in 2022 specifically for non-rootuse), but the direct-copy approach is preferred per product team
guidance (rstudio/rstudio-docker-products#734).
The
USER rstudio-pminstruction in the Containerfile meansstartup.shalready runs asrstudio-pm, so nochownis neededafter the copy. A temp file is used before the
mvso the source issafely read even if
PPM_LICENSE_FILE_PATHpoints inside the targetdirectory.
Mirrors the fix applied to
rstudio-docker-productsin July 2025(commit 66470dc). See also the equivalent fix for Connect: