From 72d8b705ffddfe1dc3afb26cff6ce54c6f74dbba Mon Sep 17 00:00:00 2001
From: Eberhard Beilharz <eb1@sil.org>
Date: Fri, 13 Jun 2025 16:31:16 +0200
Subject: [PATCH] maint(common): on Windows build as root inside docker
 container

This fixes a permission problem when we run docker from git bash.
On Windows we want to build as _root_ inside of the docker container.
This gives the necessary permissions due to the way the Windows user
is mapped to git bash/mingw and the docker container. On Linux
however we want to build as _build_ user inside the container so that
files we create are owned by the host user.

See https://github.com/keymanapp/keyman/pull/14154#issuecomment-2970577312
for further explanation.
---
 resources/docker-images/base/Dockerfile     |  9 +++++++++
 resources/docker-images/docker-build.inc.sh |  8 ++++++++
 resources/docker-images/run.sh              | 11 ++++++-----
 3 files changed, 23 insertions(+), 5 deletions(-)

diff --git a/resources/docker-images/base/Dockerfile b/resources/docker-images/base/Dockerfile
index de5a82fcf0..835806d63c 100644
--- a/resources/docker-images/base/Dockerfile
+++ b/resources/docker-images/base/Dockerfile
@@ -37,6 +37,15 @@ RUN echo "build ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers
 
 RUN <<EOF cat > /usr/bin/bashwrapper
 #!/bin/bash
+set -eu
+if [[ "${DOCKER_RUN_AS_ROOT:-}" == "1" ]] && [[ "$(id -u)" != "0" ]] ; then
+  # On Windows run as root so that the permissions are correct
+  # (root in Docker container is mapped to current user on Windows,
+  # whereas when Docker is run on Linux root is mapped to root)
+  sudo -u root -i "$0" "$@"
+  exit $?
+fi
+
 export KEYMAN_USE_NVM=1
 export DOCKER_RUNNING=true
 EOF
diff --git a/resources/docker-images/docker-build.inc.sh b/resources/docker-images/docker-build.inc.sh
index 13164196e3..e553273652 100644
--- a/resources/docker-images/docker-build.inc.sh
+++ b/resources/docker-images/docker-build.inc.sh
@@ -81,3 +81,11 @@ docker_wrapper() {
     docker "$@"
   fi
 }
+
+setup_docker() {
+  if [[ "${MSYSTEM:-}" == "MINGW64" ]]; then
+    DOCKER_RUN_ARGS="--env DOCKER_RUN_AS_ROOT=1"
+  else
+    DOCKER_RUN_ARGS=
+  fi
+}
diff --git a/resources/docker-images/run.sh b/resources/docker-images/run.sh
index 857bb90dcf..06541f7614 100755
--- a/resources/docker-images/run.sh
+++ b/resources/docker-images/run.sh
@@ -27,6 +27,7 @@ builder_parse "$@"
 
 check_for_default_values
 convert_parameters_to_args
+setup_docker
 
 if is_default_values; then
   image_version=default
@@ -37,21 +38,21 @@ else
 fi
 
 run_android() {
-  docker_wrapper run -it --rm -v "${KEYMAN_ROOT}":/home/build/build \
+  docker_wrapper run ${DOCKER_RUN_ARGS} -it --rm -v "${KEYMAN_ROOT}":/home/build/build \
     -v "${KEYMAN_ROOT}/core/build/docker-core/${build_dir}":/home/build/build/core/build \
     "keymanapp/keyman-android-ci:${image_version}" \
     "${builder_extra_params[@]}"
 }
 
 run_core() {
-  docker_wrapper run -it --rm -v "${KEYMAN_ROOT}":/home/build/build \
+  docker_wrapper run ${DOCKER_RUN_ARGS} -it --rm -v "${KEYMAN_ROOT}":/home/build/build \
     -v "${KEYMAN_ROOT}/core/build/docker-core/${build_dir}":/home/build/build/core/build \
     "keymanapp/keyman-core-ci:${image_version}" \
     "${builder_extra_params[@]}"
 }
 
 run_developer() {
-  docker_wrapper run -it --rm -v "${KEYMAN_ROOT}":/home/build/build \
+  docker_wrapper run ${DOCKER_RUN_ARGS} -it --rm -v "${KEYMAN_ROOT}":/home/build/build \
     -v "${KEYMAN_ROOT}/core/build/docker-core/${build_dir}":/home/build/build/core/build \
     "keymanapp/keyman-developer-ci:${image_version}" \
     "${builder_extra_params[@]}"
@@ -60,7 +61,7 @@ run_developer() {
 run_linux() {
   mkdir -p "${KEYMAN_ROOT}/linux/build/docker-linux/${build_dir}"
   mkdir -p "${KEYMAN_ROOT}/linux/keyman-system-service/build/docker-linux/${build_dir}"
-  docker_wrapper run -it --privileged --rm -v "${KEYMAN_ROOT}":/home/build/build \
+  docker_wrapper run ${DOCKER_RUN_ARGS} -it --privileged --rm -v "${KEYMAN_ROOT}":/home/build/build \
     -v "${KEYMAN_ROOT}/core/build/docker-core/${build_dir}":/home/build/build/core/build \
     -v "${KEYMAN_ROOT}/linux/build/docker-linux/${build_dir}":/home/build/build/linux/build \
     -v "${KEYMAN_ROOT}/linux/keyman-system-service/build/docker-linux/${build_dir}":/home/build/build/linux/keyman-system-service/build \
@@ -70,7 +71,7 @@ run_linux() {
 }
 
 run_web() {
-  docker_wrapper run -it --privileged --rm -v "${KEYMAN_ROOT}":/home/build/build \
+  docker_wrapper run ${DOCKER_RUN_ARGS} -it --privileged --rm -v "${KEYMAN_ROOT}":/home/build/build \
     -v "${KEYMAN_ROOT}/core/build/docker-core/${build_dir}":/home/build/build/core/build \
     "keymanapp/keyman-web-ci:${image_version}" \
     "${builder_extra_params[@]}"