Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DOCS-2705: Add username and env attributes for processes #3649

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

npentrel
Copy link
Collaborator

@npentrel npentrel commented Nov 1, 2024

No description provided.

@viambot viambot added the safe to build This pull request is marked safe to build from a trusted zone label Nov 1, 2024
| Executable (`name`) | string | **Required** | The command you want to execute when your machine connects to the server. On many operating systems, you can find the executable path of commands by running `which <command-name>`. |
| Arguments (`args`) | string | Optional | Arguments to follow the command. |
| Working directory (`cwd`) | string | Optional | Where you want the process to execute. Defaults to the directory where `viam-server` executes. |
| `username` (not available in builder mode) | string | Optional | Example: `"username": "ubuntu"`. |
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zaporter-work I was not able to confirm that the username attribute does anything. My assumption is that it would allow us to run the process as a user?

On my pi I added a process with this config:

{
      "env": {
        "SVC_API_KEY": "VALUE"
      },
      "username": "pi",
      "id": "process-2",
      "name": "python",
      "args": [
        "username.py"
      ],
      "cwd": "/home/pi",
      "log": true,
      "one_shot": false
    }

and this little python program:

import os
import getpass
import time

while True:
  print(1)
  print(time.sleep(1))
  raise ValueError(getpass.getuser())

I can't see anytihng printed at all and what gets raised always indicates that the process runs as root.

Does username do somethign else?

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you so much for testing this!

I have just confirmed that with the newest RDK, this now works.

A slightly easier way to test that this works is via the whoami command:

  "processes": [
    {
      "username": "pi",
      "id": "process-1",
      "name": "whoami",
      "log": true
    }
  ],

| Arguments (`args`) | string | Optional | Arguments to follow the command. |
| Working directory (`cwd`) | string | Optional | Where you want the process to execute. Defaults to the directory where `viam-server` executes. |
| `username` (not available in builder mode) | string | Optional | Example: `"username": "ubuntu"`. |
| `env` (not available in builder mode) | string | Optional | Environment variables for the process. Example: `"environment": { "SVC_API_KEY":"VALUE" }`. |
Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@zaporter-work could you confirm for me how the config for a machine reaches the machine? That's all e2e encrypted right? I think we should probably mention that here.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Talked offline -- this is not e2e encrypted. The config is encrypted in transit, but is not encrypted at rest (on the robot or in our db).

That implies that you should exercise some caution when putting api keys in here as you are trusting the security of the viam database and viam employees.

@viambot
Copy link
Member

viambot commented Nov 1, 2024

You can view a rendered version of the docs from this PR at https://docs-test.viam.dev/3649

Copy link
Member

@zaporter-work zaporter-work left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Really appreciate this. Thank you!

(all of my comments are optional and are just my opinion. Feel free to ignore any/all of them)

| Attribute | Type | Required? | Description |
| --------- | ---- | --------- | ----------- |
| Executable (`name`) | string | **Required** | The command you want to execute when your machine connects to the server. On many operating systems, you can find the executable path of commands by running `which <command-name>`. |
| Arguments (`args`) | string | Optional | Arguments to follow the command. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| Arguments (`args`) | string | Optional | Arguments to follow the command. |
| Arguments (`args`) | string[] | Optional | Arguments to follow the command. |

| Executable (`name`) | string | **Required** | The command you want to execute when your machine connects to the server. On many operating systems, you can find the executable path of commands by running `which <command-name>`. |
| Arguments (`args`) | string | Optional | Arguments to follow the command. |
| Working directory (`cwd`) | string | Optional | Where you want the process to execute. Defaults to the directory where `viam-server` executes. |
| `username` (not available in builder mode) | string | Optional | Example: `"username": "ubuntu"`. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| `username` (not available in builder mode) | string | Optional | Example: `"username": "ubuntu"`. |
| `username` (not available in builder mode) | string | Optional | Run this process as a different user. Example: `"username": "ubuntu"`. |

| Arguments (`args`) | string | Optional | Arguments to follow the command. |
| Working directory (`cwd`) | string | Optional | Where you want the process to execute. Defaults to the directory where `viam-server` executes. |
| `username` (not available in builder mode) | string | Optional | Example: `"username": "ubuntu"`. |
| `env` (not available in builder mode) | string | Optional | Environment variables for the process. Example: `"environment": { "SVC_API_KEY":"VALUE" }`. |
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Suggested change
| `env` (not available in builder mode) | string | Optional | Environment variables for the process. Example: `"environment": { "SVC_API_KEY":"VALUE" }`. |
| `env` (not available in builder mode) | Map<string, string> | Optional | Environment variables for the process. Example: `"environment": { "SVC_API_KEY":"VALUE" }`. |

(or however you write nice types in docs)

{{% /tab %}}
{{< /tabs >}}

## Set up dependencies
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Seems better down here +1

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
safe to build This pull request is marked safe to build from a trusted zone
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants