使用 docker 时如何使 lambda 用户可执行已安装的应用程序

Question

我在 AWS lambda 上使用 docker 图像。在我的 dockerfile 中，我安装了一个可执行文件（pulumi cli 工具）并通过运行RUN pulumi -version确认安装成功。

当我尝试通过我的 lambda 调用此可执行文件时，我从 python Popen 收到权限被拒绝的错误：

2023-01-25T14:41:45 ws = pulumi.automation.LocalWorkspace(work_dir="/tmp/", pulumi_home="/tmp/.pulumi")
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/site-packages/pulumi/automation/_local_workspace.py", line 125, in __init__
2023-01-25T14:41:45 pulumi_version = self._get_pulumi_version()
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/site-packages/pulumi/automation/_local_workspace.py", line 411, in _get_pulumi_version
2023-01-25T14:41:45 result = self._run_pulumi_cmd_sync(["version"])
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/site-packages/pulumi/automation/_local_workspace.py", line 430, in _run_pulumi_cmd_sync
2023-01-25T14:41:45 return _run_pulumi_cmd(args, self.work_dir, envs, on_output)
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/site-packages/pulumi/automation/_cmd.py", line 55, in _run_pulumi_cmd
2023-01-25T14:41:45 with subprocess.Popen(
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/site-packages/sentry_sdk/integrations/stdlib.py", line 193, in sentry_patched_popen_init
2023-01-25T14:41:45 rv = old_popen_init(self, *a, **kw)  # type: ignore
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/subprocess.py", line 951, in __init__
2023-01-25T14:41:45 self._execute_child(args, executable, preexec_fn, close_fds,
2023-01-25T14:41:45 File "/var/lang/lib/python3.9/subprocess.py", line 1821, in _execute_child
2023-01-25T14:41:45 raise child_exception_type(errno_num, err_msg, err_filename)
2023-01-25T14:41:45 PermissionError: [Errno 13] Permission denied: 'pulumi'[INFO]

我认为这是一个通用的 lambda 权限问题，但是一些额外的上下文以防它有帮助：我正在使用 pulumi-python 库，它通过subprocess调用这个 pulumi cli 应用程序。

我如何确保我在 Dockerfile 中安装的东西可由 lambda 用户执行？

我试过的方向：

• chmod -R a+wrx /root/.pulumi - 此命令运行正常，但在尝试调用可执行文件时仍然出现权限错误
• 我注意到我的 lambda 用户是sbx_user1051 ，所以我尝试chown -R sbx_user1051 /root/.pulumi - 这失败了，说没有这样的用户。 这使得 lambda 用户似乎是在我部署 docker 图像后创建的

Answer 1

最后，我通过将安装从 /root 文件夹移到文件夹 lambda 来解决这个问题，该文件夹用作任务执行的工作区：

FROM public.ecr.aws/lambda/python:3.9-x86_64

RUN yum install -y \
    tar \
    gzip \
    ca-certificates \
    curl \
    which \
    && yum clean all

# install pulumi - this will go to the current user's home: /root
RUN curl -fsSL https://get.pulumi.com | sh

# move pulumi to the lambda function's task root folder
RUN mv /root/.pulumi/ ${LAMBDA_TASK_ROOT} 

# grant appropriate permissions
RUN chmod -R a+wrx ${LAMBDA_TASK_ROOT}/.pulumi

RUN chmod a+x ${LAMBDA_TASK_ROOT}/.pulumi/bin/pulumi

# add to path
ENV PATH="${PATH}:${LAMBDA_TASK_ROOT}/.pulumi/bin"

...