@mastra/docker 0.9.3-alpha.1 → 0.9.4-alpha.0

package/README.md

@@ -169,6 +169,8 @@ const sandbox = new DockerSandbox({
 });
 ```
 
+If `baseImage` runs as a non-root `USER`, set `owner` to that user (for example `owner: 'node'` or `owner: '1000:1000'`). The checkout is then copied with `COPY --chown`, so git and setup commands can write to it. Without `owner`, the checkout is owned by root.
+
 ## Documentation
 
 - [Docker Sandbox integration guide](https://mastra.ai/integrations/sandboxes/docker)

package/dist/index.cjs

@@ -1600,6 +1600,11 @@ function renderSecretRun(command, secrets) {
 	const prefix = names.length > 0 ? [`export ${exports.join(" ")}`] : [];
 	return `RUN ${[...mounts, ""].join(" ")}${[...prefix, ...toCommandList(command)].join(" && ")}`;
 }
+const OWNER_PATTERN = /^[A-Za-z0-9_.-]+(:[A-Za-z0-9_.-]+)?$/;
+/** Throws unless `owner` is a `user[:group]` or `uid[:gid]` usable in `COPY --chown`. */
+function assertValidOwner(owner) {
+	if (typeof owner !== "string" || !OWNER_PATTERN.test(owner)) throw new TypeError(`owner must be user[:group] or uid[:gid], got ${JSON.stringify(owner)}`);
+}
 function synthesizeDockerfile(definition) {
 	const lines = [];
 	let mainIndex = 0;
@@ -1621,13 +1626,14 @@ function synthesizeDockerfile(definition) {
 				lines.push(`RUN ${toCommandList(operation.args[0]).join(" && ")}`);
 				break;
 			case "runWithSecrets": {
-				const [command, { secrets, output }] = operation.args;
+				const [command, { secrets, output, owner }] = operation.args;
+				if (owner !== void 0) assertValidOwner(owner);
 				const snapshot = mainStageName(mainIndex);
 				const stage = secretStageName(index);
 				lines.push(`FROM ${snapshot} AS ${stage}`, renderSecretRun(command, secrets));
 				mainIndex += 1;
 				openMain(snapshot);
-				lines.push(`COPY --from=${stage} ${output} ${output}`);
+				lines.push(`COPY ${owner !== void 0 ? `--chown=${owner} ` : ""}--from=${stage} ${output} ${output}`);
 				break;
 			}
 			case "aptInstall":
@@ -1658,12 +1664,13 @@ function canonicalOperation(operation) {
 			args: [sortedEntries(operation.args[0])]
 		};
 		case "runWithSecrets": {
-			const [command, { secrets, output }] = operation.args;
+			const [command, { secrets, output, owner }] = operation.args;
 			return {
 				method: "runWithSecrets",
 				args: [command, {
 					secrets: [...secrets].sort(),
-					output
+					output,
+					...owner !== void 0 ? { owner } : {}
 				}]
 			};
 		}
@@ -1809,11 +1816,17 @@ var DockerTemplate = class DockerTemplate {
 		});
 		const output = validateString(options.output, "output");
 		if (!output.startsWith("/")) throw new TypeError("output must be an absolute path");
+		let owner;
+		if (options.owner !== void 0) {
+			owner = validateString(options.owner, "owner");
+			assertValidOwner(owner);
+		}
 		return this.#append({
 			method: "runWithSecrets",
 			args: [validateStringOrStrings(command, "command"), {
 				secrets,
-				output
+				output,
+				...owner !== void 0 ? { owner } : {}
 			}]
 		});
 	}
@@ -2264,6 +2277,7 @@ async function resolveRepoTemplate(options, workingDirectory, resolveOptions = {
 		setupCommand: options.setupCommand,
 		workingDirectory,
 		baseImage: options.baseImage,
+		owner: options.owner,
 		dockerOptions: options.dockerOptions
 	});
 }
@@ -2290,7 +2304,8 @@ function buildRepoTemplate(inputs) {
 	}), `git -C ${shellQuote(destination)} checkout --detach ${shellQuote(sha)}`];
 	template = template.runWithSecrets(clone, {
 		secrets: tokenEnv ? [tokenEnv] : [],
-		output: destination
+		output: destination,
+		...inputs.owner !== void 0 ? { owner: inputs.owner } : {}
 	}).setWorkdir(destination);
 	const setupCommands = normalizeSetupCommands(inputs.setupCommand);
 	for (const command of setupCommands) template = template.runCmd(command);