fix(agent): set the override owner on the temp file before the rename (#24)

internal/agent/updater/compose.go

@@ -2,15 +2,11 @@ package updater
 
 import (
 	"context"
-	"errors"
 	"fmt"
 	"io"
-	"io/fs"
 	"os"
 	"os/exec"
-	"path/filepath"
 	"strings"
-	"syscall"
 	"time"
 
 	"github.com/docker/docker/api/types/container"
@@ -31,26 +27,6 @@ const (
 // job's error message; the full output is in the job log.
 const errorOutputTail = 2 << 10
 
-// chown is os.Chown; tests replace it.
-var chown = os.Chown
-
-// stackOwner returns the uid and gid the override file should have: those of
-// the existing override if there is one, else those of the stack's compose file.
-func stackOwner(overridePath, composeFile string) (uid, gid int, err error) {
-	fi, err := os.Stat(overridePath)
-	if errors.Is(err, fs.ErrNotExist) {
-		fi, err = os.Stat(composeFile)
-	}
-	if err != nil {
-		return 0, 0, err
-	}
-	st, ok := fi.Sys().(*syscall.Stat_t)
-	if !ok {
-		return 0, 0, errors.New("file owner is not available on this platform")
-	}
-	return int(st.Uid), int(st.Gid), nil
-}
-
 // tailWriter adapts a tailBuffer to io.Writer.
 type tailWriter struct{ b *tailBuffer }
 
@@ -176,18 +152,14 @@ func (e *ComposeExecutor) Execute(ctx context.Context, job protocol.JobStart, ou
 	}
 	fmt.Fprintln(out, resolveNote(job.Ref, pinned))
 
-	// The agent runs as root and WriteOverride renames a new file into place,
-	// so the override would end up root-owned. Hand it back to the stack's
-	// owner. A failure here is only a warning: the update itself is fine.
-	overridePath := filepath.Join(dir, OverrideName)
-	uid, gid, ownerErr := stackOwner(overridePath, files[0])
-	if _, err := WriteOverride(dir, service, pinned); err != nil {
+	// Giving the override the stack's owner is best effort: a failure is only
+	// a warning, the update itself is fine.
+	_, ownerErr, err := WriteOverride(dir, service, pinned, files[0])
+	if err != nil {
 		return "", err
 	}
 	if ownerErr != nil {
-		fmt.Fprintf(out, "warning: could not read the owner of %s or %s to give it to %s: %v\n", overridePath, files[0], overridePath, ownerErr)
-	} else if err := chown(overridePath, uid, gid); err != nil {
-		fmt.Fprintf(out, "warning: could not give %s the owner %d:%d: %v\n", overridePath, uid, gid, err)
+		fmt.Fprintf(out, "warning: could not give the override the stack's owner: %v\n", ownerErr)
 	}
 
 	base := composeBase(project, workingDir, files, envs)