Allow User to be specified for a CI Image or Service

Adds User option to the newly added Docker executor options
- https://gitlab.com/gitlab-org/gitlab-runner/-/issues/2750
- https://gitlab.com/gitlab-org/gitlab/-/issues/23046

Changelog: added

app/assets/javascripts/editor/schema/ci.json

@@ -528,6 +528,12 @@
                   "type": "string",
                   "minLength": 1,
                   "description": "Image architecture to pull."
+                },
+                "user": {
+                  "type": "string",
+                  "minLength": 1,
+                  "maxLength": 255,
+                  "description": "Username or UID to use for the container."
                 }
               }
             },
@@ -603,6 +609,12 @@
                     "type": "string",
                     "minLength": 1,
                     "description": "Image architecture to pull."
+                  },
+                  "user": {
+                    "type": "string",
+                    "minLength": 1,
+                    "maxLength": 255,
+                    "description": "Username or UID to use for the container."
                   }
                 }
               },

doc/ci/yaml/index.md

@@ -2468,7 +2468,8 @@ image:
 #### `image:docker`
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/27919) in GitLab 16.7. Requires GitLab Runner 16.7 or later.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/27919) in GitLab 16.7. Requires GitLab Runner 16.7 or later.
+> - `user` input option [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/137907) in GitLab 16.8.
 Use `image:docker` to pass options to the Docker executor of a GitLab Runner.
@@ -2481,6 +2482,7 @@ A hash of options for the Docker executor, which can include:
 - `platform`: Selects the architecture of the image to pull. When not specified,
     the default is the same platform as the host runner.
+- `user`: Specify the username or UID to use when running the container.
 **Example of `image:docker`**:
@@ -2491,11 +2493,13 @@ arm-sql-job:
     name: super/sql:experimental
     docker:
       platform: arm64/v8
+      user: dave
 ```
 **Additional details**:
 - `image:docker:platform` maps to the [`docker pull --platform` option](https://docs.docker.com/engine/reference/commandline/pull/#options).
+- `image:docker:user` maps to the [`docker run --user` option](https://docs.docker.com/engine/reference/commandline/run/#options).
 #### `image:pull_policy`
@@ -4350,7 +4354,8 @@ In this example, GitLab launches two containers for the job:
 #### `services:docker`
-> [Introduced](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/27919) in GitLab 16.7. Requires GitLab Runner 16.7 or later.
+> - [Introduced](https://gitlab.com/gitlab-org/gitlab-runner/-/issues/27919) in GitLab 16.7. Requires GitLab Runner 16.7 or later.
+> - `user` input option [introduced](https://gitlab.com/gitlab-org/gitlab/-/merge_requests/137907) in GitLab 16.8.
 Use `services:docker` to pass options to the Docker executor of a GitLab Runner.
@@ -4363,6 +4368,7 @@ A hash of options for the Docker executor, which can include:
 - `platform`: Selects the architecture of the image to pull. When not specified,
     the default is the same platform as the host runner.
+- `user`: Specify the username or UID to use when running the container.
 **Example of `services:docker`**:
@@ -4374,11 +4380,13 @@ arm-sql-job:
     - name: super/sql:experimental
       docker:
         platform: arm64/v8
+        user: dave
 ```
 **Additional details**:
 - `services:docker:platform` maps to the [`docker pull --platform` option](https://docs.docker.com/engine/reference/commandline/pull/#options).
+- `services:docker:user` maps to the [`docker run --user` option](https://docs.docker.com/engine/reference/commandline/run/#options).
 #### `services:pull_policy`

lib/gitlab/ci/config/entry/schemas/imageable/executor_opts.json

@@ -10,6 +10,11 @@
           "type": "string",
           "minLength": 1,
           "maxLength": 64
+        },
+        "user": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 255
         }
       },
       "additionalProperties": false

spec/frontend/editor/schema/ci/yaml_tests/negative_tests/image.yml

@@ -26,6 +26,17 @@ invalid_image_platform:
     docker:
       platform: ["arm64"] # The expected value is a string, not an array
+invalid_image_user:
+  image:
+    name: alpine:latest
+    docker:
+      user: ["dave"] # The expected value is a string, not an array
+
+empty_image_user:
+  image:
+    name: alpine:latest
+    docker:
+      user: ""
 invalid_image_executor_opts:
   image:
     name: alpine:latest

spec/frontend/editor/schema/ci/yaml_tests/negative_tests/services.yml

@@ -50,3 +50,17 @@ invalid_service_platform:
     - name: mysql:5.7
       docker:
         platform: ["arm64"] # The expected value is a string, not an array
+
+invalid_service_user:
+  script: echo "Specifying user."
+  services:
+    - name: mysql:5.7
+      docker:
+        user: ["dave"] # The expected value is a string, not an array
+
+empty_service_user:
+  script: echo "Specifying user"
+  services:
+    - name: alpine:latest
+      docker:
+        user: ""

spec/frontend/editor/schema/ci/yaml_tests/positive_tests/image.yml

@@ -30,6 +30,19 @@ valid_image_with_docker:
     docker:
       platform: linux/amd64
+valid_image_with_docker_user:
+  image:
+    name: ubuntu:latest
+    docker:
+      user: ubuntu
+
+valid_image_with_docker_multiple_options:
+  image:
+    name: ubuntu:latest
+    docker:
+      platform: linux/arm64
+      user: ubuntu
+
 valid_image_full:
   image:
     name: alpine:latest

spec/frontend/editor/schema/ci/yaml_tests/positive_tests/services.yml

@@ -36,3 +36,18 @@ services_platform_string:
     - name: mysql:5.7
       docker:
         platform: arm64
+
+services_with_docker_user:
+  script: echo "Specifying platform."
+  services:
+    - name: mysql:5.7
+      docker:
+        user: ubuntu
+
+services_with_docker_multiple_options:
+  script: echo "Specifying platform."
+  services:
+    - name: mysql:5.7
+      docker:
+        platform: linux/arm64
+        user: ubuntu

spec/lib/gitlab/ci/build/image_spec.rb

@@ -29,7 +29,7 @@
       context 'when image is defined as hash' do
         let(:entrypoint) { '/bin/sh' }
         let(:pull_policy) { %w[always if-not-present] }
-        let(:executor_opts) { { docker: { platform: 'arm64' } } }
+        let(:executor_opts) { { docker: { platform: 'arm64', user: 'dave' } } }
         let(:job) do
           create(:ci_build, options: { image: { name: image_name,
@@ -101,7 +101,7 @@
         let(:service_entrypoint) { '/bin/sh' }
         let(:service_alias) { 'db' }
         let(:service_command) { 'sleep 30' }
-        let(:executor_opts) { { docker: { platform: 'amd64' } } }
+        let(:executor_opts) { { docker: { platform: 'amd64', user: 'dave' } } }
         let(:pull_policy) { %w[always if-not-present] }
         let(:job) do
           create(:ci_build, options: { services: [{ name: service_image_name, entrypoint: service_entrypoint,

spec/lib/gitlab/ci/config/entry/image_spec.rb

@@ -112,7 +112,7 @@
         end
       end
-      context "when docker specifies an option" do
+      context "when docker specifies platform" do
         let(:config) { { name: 'image:1.0', docker: { platform: 'amd64' } } }
         it 'is valid' do
@@ -129,15 +129,73 @@
             )
           end
         end
+
+        context "when invalid data type is specified for platform option" do
+          let(:config) { { name: 'image:1.0', docker: { platform: 1 } } }
+
+          it 'raises an error' do
+            expect(entry).not_to be_valid
+            expect(entry.errors.first)
+              .to match %r{image executor opts '/docker/platform' must be a valid 'string'}
+          end
+        end
+      end
+
+      context "when docker specifies user" do
+        let(:config) { { name: 'image:1.0', docker: { user: 'dave' } } }
+
+        it 'is valid' do
+          expect(entry).to be_valid
+        end
+
+        describe '#value' do
+          it "returns value" do
+            expect(entry.value).to eq(
+              name: 'image:1.0',
+              executor_opts: {
+                docker: { user: 'dave' }
+              }
+            )
+          end
+        end
+
+        context "when user is a UID" do
+          let(:config) { { name: 'image:1.0', docker: { user: '1001' } } }
+
+          it 'is valid' do
+            expect(entry).to be_valid
+          end
+
+          describe '#value' do
+            it "returns value" do
+              expect(entry.value).to eq(
+                name: 'image:1.0',
+                executor_opts: {
+                  docker: { user: '1001' }
+                }
+              )
+            end
+          end
+        end
+
+        context "when invalid data type is specified for user option" do
+          let(:config) { { name: 'image:1.0', docker: { user: 1 } } }
+
+          it 'raises an error' do
+            expect(entry).not_to be_valid
+            expect(entry.errors.first)
+              .to match %r{image executor opts '/docker/user' must be a valid 'string'}
+          end
+        end
       end
       context "when docker specifies an invalid option" do
-        let(:config) { { name: 'image:1.0', docker: { platform: 1 } } }
+        let(:config) { { name: 'image:1.0', docker: { unknown_key: 'foo' } } }
         it 'is not valid' do
           expect(entry).not_to be_valid
           expect(entry.errors.first)
-            .to match %r{image executor opts '/docker/platform' must be a valid 'string'}
+            .to match %r{image executor opts '/docker/unknown_key' must be a valid 'schema'}
         end
       end
     end

spec/lib/gitlab/ci/config/entry/service_spec.rb

@@ -154,22 +154,45 @@
     end
     context 'when configuration has docker options' do
-      let(:config) { { name: 'postgresql:9.5', docker: { platform: 'amd64' } } }
-      describe '#valid?' do
-        it 'is valid' do
-          expect(entry).to be_valid
+      context "with platform option" do
+        let(:config) { { name: 'postgresql:9.5', docker: { platform: 'amd64' } } }
+        describe '#valid?' do
+          it 'is valid' do
+            expect(entry).to be_valid
+          end
+        end
+
+        describe '#value' do
+          it "returns value" do
+            expect(entry.value).to eq(
+              name: 'postgresql:9.5',
+              executor_opts: {
+                docker: { platform: 'amd64' }
+              }
+            )
+          end
         end
       end
-      describe '#value' do
-        it "returns value" do
-          expect(entry.value).to eq(
-            name: 'postgresql:9.5',
-            executor_opts: {
-              docker: { platform: 'amd64' }
-            }
-          )
+      context "with user option" do
+        let(:config) { { name: 'postgresql:9.5', docker: { user: 'dave' } } }
+
+        describe '#valid?' do
+          it 'is valid' do
+            expect(entry).to be_valid
+          end
+        end
+
+        describe '#value' do
+          it "returns value" do
+            expect(entry.value).to eq(
+              name: 'postgresql:9.5',
+              executor_opts: {
+                docker: { user: 'dave' }
+              }
+            )
+          end
         end
       end
     end

spec/lib/gitlab/ci/yaml_processor_spec.rb

@@ -1295,10 +1295,12 @@ module Ci
                 name: ruby:2.7
                 docker:
                   platform: linux/amd64
+                  user: dave
               services:
                 - name: postgres:11.9
                   docker:
                     platform: linux/amd64
+                    user: john
             YAML
           end
@@ -1313,9 +1315,9 @@ module Ci
               options: {
                 script: ["exit 0"],
                 image: { name: "ruby:2.7",
-                         executor_opts: { docker: { platform: 'linux/amd64' } } },
+                         executor_opts: { docker: { platform: 'linux/amd64', user: 'dave' } } },
                 services: [{ name: "postgres:11.9",
-                             executor_opts: { docker: { platform: 'linux/amd64' } } }]
+                             executor_opts: { docker: { platform: 'linux/amd64', user: 'john' } } }]
               },
               allow_failure: false,
               when: "on_success",

spec/requests/api/ci/runner/jobs_request_post_spec.rb

@@ -932,7 +932,8 @@
                 name: 'ruby',
                 executor_opts: {
                   docker: {
-                    platform: 'amd64'
+                    platform: 'amd64',
+                    user: 'dave'
                   }
                 }
               }
@@ -948,7 +949,8 @@
               'image' => { 'name' => 'ruby',
                            'executor_opts' => {
                              'docker' => {
-                               'platform' => 'amd64'
+                               'platform' => 'amd64',
+                               'user' => 'dave'
                              }
                            },
                            'pull_policy' => nil,

spec/requests/api/ci/runner/yamls/image-executor_opts-user.yml

+gitlab_ci:
+  rspec:
+    image:
+      name: alpine:latest
+      docker:
+        user: dave
+    script: echo Hello World
+
+request_response:
+  image:
+    name: alpine:latest
+    entrypoint: null
+    executor_opts:
+      docker:
+        user: dave
+    ports: []
+    pull_policy: null
+  steps:
+    - name: script
+      script: ["echo Hello World"]
+      timeout: 3600
+      when: on_success
+      allow_failure: false
+  services: []
+

spec/requests/api/ci/runner/yamls/service-executor_opts-user.yml

+gitlab_ci:
+  rspec:
+    services:
+      - name: docker:dind
+        docker:
+          user: john
+    script: echo Hello World
+
+request_response:
+  image: null
+  steps:
+    - name: script
+      script: ["echo Hello World"]
+      timeout: 3600
+      when: on_success
+      allow_failure: false
+  services:
+    - name: docker:dind
+      alias: null
+      command: null
+      entrypoint: null
+      executor_opts:
+        docker:
+          user: john
+      ports: []
+      pull_policy: null
+      variables: []