Python sidecar container cannot access Pipfile

[hisener]

After I hit the limitation in #8163, I started using the slim image docker as the binary source. For some reason, the sidecar cannot access Pipfile and I couldn't figure out why.

Main Renovate container

$ id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu)

config.js

...
  "dockerUser": "1000:1000"
...

File name: python-test/Pipfile.lock
Command failed: docker run --rm --name=renovate_python --label=renovate_child --user=1000:1000 -v "/tmp/renovate/repos/github/PicnicSupermarket/picnic-scratch":"/tmp/renovate/repos/github/PicnicSupermarket/picnic-scratch" -v "/tmp/renovate/cache":"/tmp/renovate/cache" -v "/tmp/renovate/cache/others/pipenv":"/tmp/renovate/cache/others/pipenv" -e PIPENV_CACHE_DIR -w "/tmp/renovate/repos/github/PicnicSupermarket/picnic-scratch/python-test" docker.io/renovate/python:3.8.6 bash -l -c "pip install --user pipenv && pipenv lock"
Creating a virtualenv for this project...
Pipfile: /tmp/renovate/repos/github/PicnicSupermarket/picnic-scratch/python-test/Pipfile
Using /usr/local/python/3.8.6/bin/python3 (3.8.6) to create virtualenv...

⠋ Creating virtual environment...�
⠙ Creating virtual environment...�
⠏ Creating virtual environment...created virtual environment CPython3.8.6.final.0-64 in 632ms
  creator CPython3Posix(dest=/home/ubuntu/.local/share/virtualenvs/python-test-zKYyy-c-, clear=False, no_vcs_ignore=False, global=False)
  seeder FromAppData(download=False, pip=bundle, setuptools=bundle, wheel=bundle, via=copy, app_data_dir=/home/ubuntu/.local/share/virtualenv)
    added seed packages: pip==20.3.1, setuptools==51.0.0, wheel==0.36.1
  activators BashActivator,CShellActivator,FishActivator,PowerShellActivator,PythonActivator,XonshActivator

�✔ Successfully created virtual environment! 
Virtualenv location: /home/ubuntu/.local/share/virtualenvs/python-test-zKYyy-c-
Creating a Pipfile for this project...
Traceback (most recent call last):
...
PermissionError: [Errno 13] Permission denied: '/tmp/renovate/repos/github/PicnicSupermarket/picnic-scratch/python-test/Pipfile'

Currently, I have the following setup (removed unrelated parts):

      container:
        image: renovate/renovate:24.11.2-slim
        command:
          - /bin/bash
          - -c
        args:
          - id && renovate
        env:
          - name: DOCKER_HOST
            value: 127.0.0.1
        securityContext:
          runAsNonRoot: true
          runAsGroup: 1000
          fsGroup: 1000
      sidecars:
        - name: renovate-dind
          image: docker:19.03.14-dind
          env:
            - name: DOCKER_TLS_CERTDIR
              value: ""
          securityContext:
            privileged: true

[rarkins]

1. Don't configure dockerUser unless you need to
2. Have you mapped /tmp/renovate on your host to /tmp/renovate in your main Renovate container? It needs to be on the host so that it can be mapped to the sibling containers

[JamieMagee]

Created renovatebot/helm-charts#91 to track the request.

[viceice]

@hisener can you paste a full kubernetes yaml as new answer, so we can mark it as answer and reuse it for our helm chart? I'm trying to move my renovate from ci pipeline to kubernetes cron.

[hisener]

We are running Renovate as part of an Argo workflow, so I don't have a plain Kubernetes manifest. But I can share the description of the Renovate step's pod (output of kubectl -n renovate describe oss-parent-...) if that helps.

[viceice]

Ok, so it won't help. Thanks. I think i need a pvc to create a running docker dind deployment and a renovate cron job.

Does anybody know if i can run the docker dind as sidecar in hte cron job? I think this will never end the cron job. 🤔

[viceice]

ok, i found this 😕
kubernetes/kubernetes#25908 (comment)