Run SDK Docker builds as the host user

.gitignore

@@ -5,5 +5,7 @@ sdks/**/examples
 sdks/**/test_fixtures
 sdks/**/vendor
 vendor
+.composer
+.docker
 .idea
 .gradle

bin/docker-run

@@ -0,0 +1,11 @@
+#!/usr/bin/env bash
+
+# SDK builds bind-mount the checkout. The user flag comes from docker-user-args
+# so rootful Docker does not leave root-owned files behind.
+
+set -euo pipefail
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+mapfile -t DOCKER_USER_ARGS < <("${DIR}/docker-user-args")
+
+exec docker run --rm "${DOCKER_USER_ARGS[@]}" "$@"

bin/docker-user-args

@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+# Prints docker run arguments so a bind-mounted repo is not owned by root.
+# Rootless Docker already maps container root to the host user, so it keeps
+# --user root:root. Rootful Docker does not, and that is what leaves SDK files
+# that a later git checkout cannot replace. Set DOCKER_RUN_AS_ROOT=1 to force
+# the old behavior.
+
+set -euo pipefail
+
+if [[ "${DOCKER_RUN_AS_ROOT:-}" == "1" ]]; then
+  printf '%s\n' --user root:root
+  exit 0
+fi
+
+security="$(docker info --format '{{range .SecurityOptions}}{{println .}}{{end}}' 2>/dev/null || true)"
+if grep -q rootless <<<"${security}"; then
+  printf '%s\n' --user root:root
+  exit 0
+fi
+
+printf '%s\n' --user "$(id -u):$(id -g)"

bin/normalize-sdk-modes

@@ -0,0 +1,18 @@
+#!/usr/bin/env bash
+
+# openapi-generator's umask marks some generated sources executable. The SDK
+# trees keep those files at 644. GitHub Actions owns the workspace already.
+
+set -euo pipefail
+
+if [[ -n "${GITHUB_ACTIONS:-}" ]]; then
+  exit 0
+fi
+
+for path in "$@"; do
+  if [[ -f "${path}" ]]; then
+    chmod 644 "${path}"
+  elif [[ -d "${path}" ]]; then
+    find "${path}" -type f -exec chmod 644 {} \;
+  fi
+done

bin/php

@@ -1,21 +1,13 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/openapi"
 
-if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
+if [[ -n "${GITHUB_ACTIONS:-}" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
   printf "\nLogging in to docker.com ...\n"
   echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
 fi
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/php-in-docker" /app/openapi "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"

bin/php-in-docker

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+# Composer writes both the SDK tree and its cache. The cache lives on the host
+# so the user selected by docker-run can write it. Set PHP_DOCKER_PLATFORM to
+# pass --platform (the PHP SDK images are amd64).
+
+set -euo pipefail
+
+DIR=$(cd "$(dirname "$0")" && pwd)
+WORKING_DIR="$1"
+ROOT_DIR="$2"
+IMAGE="$3"
+shift 3
+
+mkdir -p "${ROOT_DIR}/.docker/composer"
+
+platform=()
+if [[ -n "${PHP_DOCKER_PLATFORM:-}" ]]; then
+  platform=(--platform "${PHP_DOCKER_PLATFORM}")
+fi
+
+exec "${DIR}/docker-run" \
+  "${platform[@]}" \
+  -v "${ROOT_DIR}:${WORKING_DIR}" \
+  -v "${ROOT_DIR}/.docker/composer:/tmp/composer" \
+  -e COMPOSER_HOME=/tmp/composer \
+  -w "${WORKING_DIR}" \
+  "${IMAGE}" \
+  "$@"

bin/sandbox-dotnet

@@ -1,29 +1,35 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/dotnet"
 TARGET_DIR="${DIR}/../sandbox/dotnet"
 ARTIFACTS_DIR="${DIR}/../sandbox/dotnet/artifacts"
 
-mkdir -p "${ARTIFACTS_DIR}"
+mkdir -p "${ARTIFACTS_DIR}" "${SDK_DIR}/.docker/nuget" "${SDK_DIR}/.docker/home"
 rm -f "${ARTIFACTS_DIR}/*.nupkg"
 rm -f "${TARGET_DIR}/src/Dropbox.SignSandbox/*.cs"
 cp "${SDK_DIR}/templates/Entry.cs" "${TARGET_DIR}/src/Dropbox.SignSandbox/Entry.cs"
 
-docker run --rm -it \
+"${DIR}/docker-run" -it \
   -v "${SDK_DIR}:${WORKING_DIR}" \
   -v "${ARTIFACTS_DIR}:/artifacts" \
   -v "${TARGET_DIR}:/target" \
+  -v "${SDK_DIR}/.docker/home:/tmp/home" \
+  -v "${SDK_DIR}/.docker/nuget:/tmp/nuget" \
+  -e HOME=/tmp/home \
+  -e NUGET_PACKAGES=/tmp/nuget \
   -w "${WORKING_DIR}" \
-  -u root:root \
   mcr.microsoft.com/dotnet/sdk:9.0 dotnet pack -o /artifacts
 
-docker run --rm -it \
+"${DIR}/docker-run" -it \
   -v "${TARGET_DIR}:${WORKING_DIR}" \
+  -v "${SDK_DIR}/.docker/home:/tmp/home" \
+  -v "${SDK_DIR}/.docker/nuget:/tmp/nuget" \
+  -e HOME=/tmp/home \
+  -e NUGET_PACKAGES=/tmp/nuget \
   -w "${WORKING_DIR}" \
-  -u root:root \
   mcr.microsoft.com/dotnet/sdk:9.0 dotnet build

bin/sandbox-java

@@ -1,24 +1,25 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/java-v2"
 TARGET_DIR="${DIR}/../sandbox/java"
 ARTIFACTS_DIR="${DIR}/../sandbox/java/artifacts"
 
-mkdir -p "${ARTIFACTS_DIR}"
+mkdir -p "${ARTIFACTS_DIR}" "${SDK_DIR}/.docker/gradle"
 rm -f "${ARTIFACTS_DIR}/*.jar"
 rm -f "${TARGET_DIR}/src/main/java/com/dropbox/sign_sandbox/*.java"
 cp "${SDK_DIR}/templates/Main.java" "${TARGET_DIR}/src/main/java/com/dropbox/sign_sandbox/Main.java"
 
-docker run --rm -it \
+"${DIR}/docker-run" -it \
   -v "${SDK_DIR}:${WORKING_DIR}" \
   -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-gradle-cache:/home/gradle/.gradle" \
-  -v "dropbox-sign-sdk-maven-cache:/root/.m2" \
+  -v "${SDK_DIR}/.docker/gradle:/tmp/gradle-user-home" \
+  -e GRADLE_USER_HOME=/tmp/gradle-user-home \
+  -e HOME=/tmp/gradle-user-home \
   -w "${WORKING_DIR}" \
   -e GEN_DIR=/app \
   gradle:7.6.1-jdk11 ./gradlew clean fatJar

bin/sandbox-node

@@ -1,40 +1,35 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/node"
 TARGET_DIR="${DIR}/../sandbox/node"
 ARTIFACTS_DIR="${DIR}/../sandbox/node/artifacts"
 
-mkdir -p "${ARTIFACTS_DIR}"
+mkdir -p "${ARTIFACTS_DIR}" "${SDK_DIR}/.docker/npm" "${SDK_DIR}/.docker/home"
 rm -f "${ARTIFACTS_DIR}/*.tgz"
 rm -f "${TARGET_DIR}/src/*.ts"
 rm -f "${TARGET_DIR}/src/*.js"
 rm -f "${TARGET_DIR}/package-lock.json"
 rm -rf "${TARGET_DIR}/node_modules"
 
-docker run -it --rm \
-  -v "${SDK_DIR}:${WORKING_DIR}" \
-  -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -w "${WORKING_DIR}" \
-  node:22 npm install
-
-docker run -it --rm \
-  -v "${SDK_DIR}:${WORKING_DIR}" \
-  -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -w "${WORKING_DIR}" \
-  node:22 npm run build
-
-docker run -it --rm \
-  -v "${SDK_DIR}:${WORKING_DIR}" \
-  -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-npm-cache:/root/.npm" \
-  -w "${WORKING_DIR}" \
-  node:22 npm pack --pack-destination /artifacts
+node_run() {
+  "${DIR}/docker-run" -it \
+    -v "${SDK_DIR}:${WORKING_DIR}" \
+    -v "${ARTIFACTS_DIR}:/artifacts" \
+    -v "${SDK_DIR}/.docker/npm:/tmp/npm-cache" \
+    -v "${SDK_DIR}/.docker/home:/tmp/home" \
+    -e HOME=/tmp/home \
+    -e npm_config_cache=/tmp/npm-cache \
+    -w "${WORKING_DIR}" \
+    node:22 "$@"
+}
+
+node_run npm install
+node_run npm run build
+node_run npm pack --pack-destination /artifacts
 
 mv "${ARTIFACTS_DIR}/"*.tgz "${ARTIFACTS_DIR}/dropbox-sign-sdk.tgz"

bin/sandbox-ruby

@@ -1,32 +1,34 @@
 #!/usr/bin/env bash
 
-set -e
+set -euo pipefail
 
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 
 WORKING_DIR="/app/openapi"
 SDK_DIR="${DIR}/../sdks/ruby"
 TARGET_DIR="${DIR}/../sandbox/ruby"
 ARTIFACTS_DIR="${DIR}/../sandbox/ruby/artifacts"
 
 rm -rf "${ARTIFACTS_DIR}"
-mkdir -p "${ARTIFACTS_DIR}/gems"
+mkdir -p "${ARTIFACTS_DIR}/gems" "${SDK_DIR}/.docker/gem" "${SDK_DIR}/.docker/bundle"
 
-docker run --rm \
-  -e GEM_HOME="/.gem-cache" \
-  -e BUNDLE_PATH="/.bundle-cache" \
+"${DIR}/docker-run" \
+  -e GEM_HOME=/tmp/gem \
+  -e BUNDLE_PATH=/tmp/bundle \
+  -e HOME=/tmp/gem \
   -v "${SDK_DIR}:${WORKING_DIR}" \
   -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-gem-cache:/.gem-cache" \
-  -v "dropbox-sign-sdk-bundle-cache:/.bundle-cache" \
+  -v "${SDK_DIR}/.docker/gem:/tmp/gem" \
+  -v "${SDK_DIR}/.docker/bundle:/tmp/bundle" \
   -w "${WORKING_DIR}" \
   ruby:3.4 gem build dropbox-sign.gemspec -o /artifacts/gems/dropbox-sign.gem
 
-docker run --rm \
-  -e GEM_HOME="/.gem-cache" \
-  -e BUNDLE_PATH="/.bundle-cache" \
+"${DIR}/docker-run" \
+  -e GEM_HOME=/tmp/gem \
+  -e BUNDLE_PATH=/tmp/bundle \
+  -e HOME=/tmp/gem \
   -v "${ARTIFACTS_DIR}:/artifacts" \
-  -v "dropbox-sign-sdk-gem-cache:/.gem-cache" \
-  -v "dropbox-sign-sdk-bundle-cache:/.bundle-cache" \
+  -v "${SDK_DIR}/.docker/gem:/tmp/gem" \
+  -v "${SDK_DIR}/.docker/bundle:/tmp/bundle" \
   -w "/artifacts" \
   ruby:3.4 gem generate_index

sdks/dotnet/bin/dotnet

@@ -1,15 +1,18 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
 WORKING_DIR="/app/dotnet"
 
-docker run --rm \
+mkdir -p "${ROOT_DIR}/.docker/nuget" "${ROOT_DIR}/.docker/home"
+
+exec "${DIR}/../../../bin/docker-run" \
   -v "${ROOT_DIR}:${WORKING_DIR}" \
+  -v "${ROOT_DIR}/.docker/home:/tmp/home" \
+  -v "${ROOT_DIR}/.docker/nuget:/tmp/nuget" \
+  -e HOME=/tmp/home \
+  -e NUGET_PACKAGES=/tmp/nuget \
   -w "${WORKING_DIR}" \
-  -u root:root \
   mcr.microsoft.com/dotnet/sdk:8.0 "$@"

sdks/dotnet/bin/php

@@ -1,16 +1,8 @@
 #!/usr/bin/env bash
 
-# Warning: You should run this from rootless Docker (or Podman, or other)
+set -euo pipefail
 
-set -e
-
-DIR=$(cd `dirname $0` && pwd)
+DIR=$(cd "$(dirname "$0")" && pwd)
 ROOT_DIR="${DIR}/.."
-WORKING_DIR="/app/dotnet"
 
-docker run --rm \
-  -v "${ROOT_DIR}:${WORKING_DIR}" \
-  -v "dropbox-sign-sdk-composer-cache:/.composer" \
-  -w "${WORKING_DIR}" \
-  -u root:root \
-  jtreminio/php-cli:7.4 "$@"
+exec "${DIR}/../../../bin/php-in-docker" /app/dotnet "${ROOT_DIR}" jtreminio/php-cli:7.4 "$@"

sdks/dotnet/run-build

@@ -16,7 +16,7 @@ fi
 rm -f "${DIR}/src/Dropbox.Sign/Api/"*.cs
 rm -f "${DIR}/src/Dropbox.Sign/Model/"*.cs
 
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}/:/local" \
   openapitools/openapi-generator-cli:v7.12.0 generate \
     -i "/local/openapi-sdk.yaml" \
@@ -35,28 +35,26 @@ printf "Adding examples to Docs ...\n"
 bash "${DIR}/bin/php" ./bin/generate-examples.php
 
 printf "Replacing strings ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/replace
 
 printf "Scanning for prohibited keywords ...\n"
-docker run --rm \
+"${DIR}/../../bin/docker-run" \
   -v "${DIR}:${WORKING_DIR}" \
   -w "${WORKING_DIR}" \
   perl bash ./bin/scan_for
 
 printf "Adding old-style constant names ...\n"
 bash "${DIR}/bin/php" ./bin/copy-constants.php
 
-# avoid docker messing with permissions
-if [[ -z "$GITHUB_ACTIONS" ]]; then
-  chmod 644 "${DIR}/README.md"
-  find "${DIR}/docs/" -type f -exec chmod 644 {} \;
-  find "${DIR}/examples/" -type f -exec chmod 644 {} \;
-  find "${DIR}/test_fixtures/" -type f -exec chmod 644 {} \;
-  find "${DIR}/src/" -type f -exec chmod 644 {} \;
-fi
+"${DIR}/../../bin/normalize-sdk-modes" \
+  "${DIR}/README.md" \
+  "${DIR}/docs" \
+  "${DIR}/examples" \
+  "${DIR}/test_fixtures" \
+  "${DIR}/src"
 
 printf "Running tests ...\n"
 bash "${DIR}/bin/dotnet" dotnet test src/Dropbox.Sign.Test/