Docker sample does not work on Windows about artifacts-credprovider HOT 6 OPEN

maybe stale?

from artifacts-credprovider.

As for a fix here, ideally the credential provider can be installed as ContainerUser without elevating, but there are a few unfortunate limitations here:

1. The install script uses the TEMP env var (and .NET methods based off that) to create temporary files, but ContainerUser doesn't have any access to delete the temp files it creates (hence the icacls workaround to resolve this, granting read/delete permissions).
2. On Nano Server there just isn't a good scratch location for temp files, so creating and cleaning up temp files needs to be done in the docker build itself.

The core problem imho is that these script-based install mechanisms leave a lot to be desired and run into these platform limitations both on capability and differences. Using a mechanism like the proposed NuGet/Home#12567 would make all of these problems obsolete and allow the credential provider install to work cross-platform.

In the near term however, I'd propose the following changes to keep the spirit of the ContainerUser permission model (and the docker sample's goal of building within the container as a low-privileged account in a 2-phase build for isolation):

1. Update the installcredprovider.ps1 script to allow an install path to be specified, falling back to TEMP if none is specified.
2. Update the docker sample to install into a custom temp folder, such that it has full permissions to clean up after install.

from artifacts-credprovider.

Able to do this in the sample itself with dotnet/dotnet-docker#4828

from artifacts-credprovider.

This issue has had no activity in 90 days. Please comment if it is not actually stale.

from artifacts-credprovider.

not stale.

from artifacts-credprovider.

This issue has had no activity in 90 days. Please comment if it is not actually stale.

from artifacts-credprovider.