korbit-ai[bot] commented on code in PR #33403:
URL: https://github.com/apache/superset/pull/33403#discussion_r2083321968


##########
loonar/install-superset.sh:
##########
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Ensure Docker daemon is running before running compose
+if ! pgrep -x dockerd > /dev/null 2>&1; then
+  echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"
+  exit 1
+fi
+
+# The --build argument ensures all the layers are up-to-date
+if command -v docker-compose > /dev/null 2>&1; then
+  docker-compose build --no-cache
+  
+  
+  docker compose up --build

Review Comment:
   ### Inconsistent Docker Compose Version Usage <sub>![category 
Performance](https://img.shields.io/badge/Performance-4f46e5)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The script mixes 'docker-compose' (v1) and 'docker compose' (v2) commands, 
and runs both build commands redundantly.
   
   ###### Why this matters
   This will cause confusion and unnecessary rebuilds, doubling the build time 
and potentially causing conflicts between the two versions.
   
   ###### Suggested change ∙ *Feature Preview*
   Choose one version of Docker Compose and use it consistently:
   ```bash
   if docker compose version > /dev/null 2>&1; then
     docker compose up --build
   else
     echo "Error: 'docker compose' is not available. Please install Docker 
Compose v2."
     exit 1
   fi
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/c7cfaabc-7000-4e2a-8f11-388940e550e6/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/c7cfaabc-7000-4e2a-8f11-388940e550e6?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/c7cfaabc-7000-4e2a-8f11-388940e550e6?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/c7cfaabc-7000-4e2a-8f11-388940e550e6?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/c7cfaabc-7000-4e2a-8f11-388940e550e6)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:9423dadd-2a74-473c-8faa-930d26b93752 -->
   
   
   [](9423dadd-2a74-473c-8faa-930d26b93752)



##########
loonar/install-superset.sh:
##########
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Ensure Docker daemon is running before running compose
+if ! pgrep -x dockerd > /dev/null 2>&1; then
+  echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"
+  exit 1
+fi
+
+# The --build argument ensures all the layers are up-to-date
+if command -v docker-compose > /dev/null 2>&1; then

Review Comment:
   ### Incorrect Version Check <sub>![category 
Functionality](https://img.shields.io/badge/Functionality-0284c7)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The script checks for 'docker-compose' (v1) but suggests installing Docker 
Compose v2 in the error message.
   
   ###### Why this matters
   Users might have v2 installed (docker compose) but the script will fail 
because it's checking for v1 (docker-compose), leading to false negative errors.
   
   ###### Suggested change ∙ *Feature Preview*
   Update the version check to look for Docker Compose v2:
   ```bash
   if ! docker compose version > /dev/null 2>&1; then
     echo "Error: 'docker compose' is not available. Please install Docker 
Compose v2."
     exit 1
   fi
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/dcf3a62a-8850-4ddd-9df2-f84cef5838c5/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/dcf3a62a-8850-4ddd-9df2-f84cef5838c5?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/dcf3a62a-8850-4ddd-9df2-f84cef5838c5?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/dcf3a62a-8850-4ddd-9df2-f84cef5838c5?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/dcf3a62a-8850-4ddd-9df2-f84cef5838c5)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:02934ba8-9f57-4b90-997a-743aec90363c -->
   
   
   [](02934ba8-9f57-4b90-997a-743aec90363c)



##########
loonar/install-superset.sh:
##########
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Ensure Docker daemon is running before running compose
+if ! pgrep -x dockerd > /dev/null 2>&1; then
+  echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"
+  exit 1
+fi
+
+# The --build argument ensures all the layers are up-to-date
+if command -v docker-compose > /dev/null 2>&1; then
+  docker-compose build --no-cache
+  
+  
+  docker compose up --build

Review Comment:
   ### Poor Code Structure with Multiple Empty Lines <sub>![category 
Design](https://img.shields.io/badge/Design-0d9488)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   Multiple empty lines between commands reduce code readability and violate 
clean code principles.
   
   ###### Why this matters
   Poor code formatting makes the script harder to maintain and understand, 
violating the KISS principle.
   
   ###### Suggested change ∙ *Feature Preview*
   Remove extra empty lines between commands to maintain clean and consistent 
formatting.
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/b7919ebe-c9a0-4d2b-adda-642fa330304d/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/b7919ebe-c9a0-4d2b-adda-642fa330304d?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/b7919ebe-c9a0-4d2b-adda-642fa330304d?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/b7919ebe-c9a0-4d2b-adda-642fa330304d?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/b7919ebe-c9a0-4d2b-adda-642fa330304d)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:2c1f15fb-1aa5-40ef-9ff2-313cf9e2aedc -->
   
   
   [](2c1f15fb-1aa5-40ef-9ff2-313cf9e2aedc)



##########
loonar/install-docker-rootless.sh:
##########
@@ -0,0 +1,90 @@
+#!/bin/bash
+
+# This script sets up Docker in rootless mode for improved security.
+# Rootless Docker allows a non-root user to run containers without requiring 
elevated privileges,
+# reducing the risk of system compromise in case of container breakout.
+
+set -e
+
+USERNAME="dockeruser"

Review Comment:
   ### Hardcoded configuration value <sub>![category 
Design](https://img.shields.io/badge/Design-0d9488)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The username is hardcoded in the script, limiting flexibility and 
reusability.
   
   ###### Why this matters
   The script cannot be easily adapted for different installation scenarios 
where a different username might be preferred.
   
   ###### Suggested change ∙ *Feature Preview*
   Make the username configurable through a command-line argument with a 
default value:
   ```bash
   USERNAME=${1:-"dockeruser"}
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/d0dcc85c-7a84-4ad9-97bf-0663099b2022/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/d0dcc85c-7a84-4ad9-97bf-0663099b2022?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/d0dcc85c-7a84-4ad9-97bf-0663099b2022?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/d0dcc85c-7a84-4ad9-97bf-0663099b2022?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/d0dcc85c-7a84-4ad9-97bf-0663099b2022)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:aa14f08b-4a2d-47d4-8ac9-762207e60744 -->
   
   
   [](aa14f08b-4a2d-47d4-8ac9-762207e60744)



##########
loonar/install-superset.sh:
##########
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Ensure Docker daemon is running before running compose
+if ! pgrep -x dockerd > /dev/null 2>&1; then

Review Comment:
   ### Missing Success Logging <sub>![category 
Logging](https://img.shields.io/badge/Logging-4f46e5)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   Missing informational logging about the script's progress and successful 
operations.
   
   ###### Why this matters
   Without success logs, it's difficult to track the script's execution flow 
and verify successful operations in production environments.
   
   ###### Suggested change ∙ *Feature Preview*
   Add informational logging for key operations:
   ```bash
   echo "[INFO] Checking Docker daemon status..."
   if ! pgrep -x dockerd > /dev/null 2>&1; then
     echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"
     exit 1
   fi
   echo "[INFO] Docker daemon is running"
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/5ca1a364-2174-4a46-83c7-3d8a96b84ced/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/5ca1a364-2174-4a46-83c7-3d8a96b84ced?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/5ca1a364-2174-4a46-83c7-3d8a96b84ced?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/5ca1a364-2174-4a46-83c7-3d8a96b84ced?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/5ca1a364-2174-4a46-83c7-3d8a96b84ced)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:4063b577-6680-4e05-acbc-8b7e036429c1 -->
   
   
   [](4063b577-6680-4e05-acbc-8b7e036429c1)



##########
loonar/install-superset.sh:
##########
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Ensure Docker daemon is running before running compose
+if ! pgrep -x dockerd > /dev/null 2>&1; then
+  echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"
+  exit 1
+fi
+
+# The --build argument ensures all the layers are up-to-date
+if command -v docker-compose > /dev/null 2>&1; then
+  docker-compose build --no-cache
+  
+  
+  docker compose up --build

Review Comment:
   ### Unclear build process documentation <sub>![category 
Documentation](https://img.shields.io/badge/Documentation-7c3aed)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The comment only explains what the --build flag does, but not why two 
different Docker Compose commands are being used or why --no-cache is needed.
   
   ###### Why this matters
   Without understanding the purpose of using both commands and the --no-cache 
flag, maintainers might inadvertently remove or modify these important build 
steps.
   
   ###### Suggested change ∙ *Feature Preview*
   # Rebuild all images from scratch (--no-cache) to ensure latest dependencies
   # Then start containers with updated images
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9e0d9d4a-f252-478e-b40c-04244dadb2fb/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9e0d9d4a-f252-478e-b40c-04244dadb2fb?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9e0d9d4a-f252-478e-b40c-04244dadb2fb?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9e0d9d4a-f252-478e-b40c-04244dadb2fb?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9e0d9d4a-f252-478e-b40c-04244dadb2fb)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:d8ca08aa-d5a8-418d-b265-2ee6acf89153 -->
   
   
   [](d8ca08aa-d5a8-418d-b265-2ee6acf89153)



##########
loonar/install-superset.sh:
##########
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+# Ensure Docker daemon is running before running compose
+if ! pgrep -x dockerd > /dev/null 2>&1; then
+  echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"

Review Comment:
   ### Inconsistent Error Message Format <sub>![category 
Logging](https://img.shields.io/badge/Logging-4f46e5)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   Inconsistent error message format. The script uses [ERROR] in one place and 
'Error:' in another, lacking a standardized logging format.
   
   ###### Why this matters
   Inconsistent error message formats make it harder to parse logs and create 
monitoring rules. This impacts log aggregation and automated error detection.
   
   ###### Suggested change ∙ *Feature Preview*
   Standardize error message format throughout the script:
   ```bash
   echo "[ERROR] Docker daemon is not running. Please start Docker with: sudo 
systemctl start docker"
   # ...
   echo "[ERROR] 'docker compose' is not available. Please install Docker 
Compose v2."
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/87ae8938-4e2c-462d-b269-affacda89383/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/87ae8938-4e2c-462d-b269-affacda89383?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/87ae8938-4e2c-462d-b269-affacda89383?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/87ae8938-4e2c-462d-b269-affacda89383?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/87ae8938-4e2c-462d-b269-affacda89383)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:5e3e621d-c84b-41b9-b737-9b8d82a97c6d -->
   
   
   [](5e3e621d-c84b-41b9-b737-9b8d82a97c6d)



##########
loonar/install-docker-rootless.sh:
##########
@@ -0,0 +1,90 @@
+#!/bin/bash
+
+# This script sets up Docker in rootless mode for improved security.
+# Rootless Docker allows a non-root user to run containers without requiring 
elevated privileges,
+# reducing the risk of system compromise in case of container breakout.
+
+set -e
+
+USERNAME="dockeruser"
+DOCKER_INSTALL_URL="https://get.docker.com/rootless";
+
+# Check if the user already exists
+if id "$USERNAME" &>/dev/null; then
+  echo "👤 User $USERNAME already exists. Skipping creation."
+else
+  echo "👤 Creating user $USERNAME..."
+  useradd -m -s /bin/bash "$USERNAME"
+fi
+
+# Check if dependencies are already installed
+REQUIRED_PKGS=(uidmap dbus-user-session curl)

Review Comment:
   ### Undocumented package dependencies <sub>![category 
Documentation](https://img.shields.io/badge/Documentation-7c3aed)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The purpose of each required package should be documented.
   
   ###### Why this matters
   Future maintainers may remove packages they think are unnecessary without 
understanding their purpose.
   
   ###### Suggested change ∙ *Feature Preview*
   # Required packages:
   # - uidmap: For user namespace mapping
   # - dbus-user-session: For systemd user service management
   # - curl: For downloading Docker installation script
   REQUIRED_PKGS=(uidmap dbus-user-session curl)
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/6e06d117-251e-4e07-b624-d5b3ebd897e1/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/6e06d117-251e-4e07-b624-d5b3ebd897e1?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/6e06d117-251e-4e07-b624-d5b3ebd897e1?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/6e06d117-251e-4e07-b624-d5b3ebd897e1?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/6e06d117-251e-4e07-b624-d5b3ebd897e1)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:b638ad45-bbb2-4a96-9e7d-56029ab9ba09 -->
   
   
   [](b638ad45-bbb2-4a96-9e7d-56029ab9ba09)



##########
loonar/install-docker-rootless.sh:
##########
@@ -0,0 +1,90 @@
+#!/bin/bash
+
+# This script sets up Docker in rootless mode for improved security.
+# Rootless Docker allows a non-root user to run containers without requiring 
elevated privileges,
+# reducing the risk of system compromise in case of container breakout.
+
+set -e
+
+USERNAME="dockeruser"
+DOCKER_INSTALL_URL="https://get.docker.com/rootless";
+
+# Check if the user already exists
+if id "$USERNAME" &>/dev/null; then
+  echo "👤 User $USERNAME already exists. Skipping creation."
+else
+  echo "👤 Creating user $USERNAME..."
+  useradd -m -s /bin/bash "$USERNAME"
+fi
+
+# Check if dependencies are already installed
+REQUIRED_PKGS=(uidmap dbus-user-session curl)
+MISSING_PKGS=()
+for pkg in "${REQUIRED_PKGS[@]}"; do
+  dpkg -s "$pkg" &>/dev/null || MISSING_PKGS+=("$pkg")
+done
+if [ ${#MISSING_PKGS[@]} -eq 0 ]; then
+  echo "📦 Dependencies already installed."
+else
+  echo "📦 Installing dependencies: ${MISSING_PKGS[*]}..."
+  apt update && apt install -y "${MISSING_PKGS[@]}"
+fi
+
+# Check if rootless Docker is already installed
+if sudo -u "$USERNAME" test -x 
"/home/$USERNAME/bin/dockerd-rootless-setuptool.sh"; then
+  echo "🐳 Rootless Docker already installed for $USERNAME."
+else
+  echo "🐳 Installing rootless Docker for $USERNAME..."
+  sudo -u "$USERNAME" bash -c "curl -fsSL $DOCKER_INSTALL_URL | sh || true"
+fi
+
+# Check if rootlesskit failed due to AppArmor restriction
+if grep -q "apparmor_restrict_unprivileged_userns" 
/home/$USERNAME/.docker/rootlesskit.log 2>/dev/null || \
+   grep -q "permission denied" /home/$USERNAME/.docker/rootlesskit.log 
2>/dev/null; then
+  echo "⚠️ Detected AppArmor restriction. Applying AppArmor exception for 
rootlesskit..."
+
+  APPARMOR_FILE="/etc/apparmor.d/home.$USERNAME.bin.rootlesskit"
+  if [ -f "$APPARMOR_FILE" ]; then
+    echo "🔒 AppArmor profile already exists. Skipping creation."
+  else
+    cat <<EOT | sudo tee "$APPARMOR_FILE"
+# ref: 
https://ubuntu.com/blog/ubuntu-23-10-restricted-unprivileged-user-namespaces
+abi <abi/4.0>,
+include <tunables/global>
+
+/home/$USERNAME/bin/rootlesskit flags=(unconfined) {
+  userns,
+
+  # Site-specific additions and overrides. See local/README for details.
+  include if exists <local/home.$USERNAME.bin.rootlesskit>
+}
+EOT
+  fi
+
+  sudo systemctl restart apparmor.service
+  echo "🔁 AppArmor profile applied and reloaded."
+  echo "🔄 Re-running rootless Docker setup..."
+  sudo -u "$USERNAME" bash -c "$HOME/bin/dockerd-rootless-setuptool.sh install"

Review Comment:
   ### Incorrect HOME directory reference in sudo command <sub>![category 
Functionality](https://img.shields.io/badge/Functionality-0284c7)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The $HOME variable in this command will resolve to the root user's home 
directory instead of the dockeruser's home directory when executed with sudo.
   
   ###### Why this matters
   This will cause the Docker rootless setup to fail as it will look for the 
setup script in the wrong directory.
   
   ###### Suggested change ∙ *Feature Preview*
   Replace `$HOME` with `/home/$USERNAME` to ensure the correct home directory 
is used:
   ```bash
   sudo -u "$USERNAME" bash -c 
"/home/$USERNAME/bin/dockerd-rootless-setuptool.sh install"
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/3d93b8c8-574d-4388-97b4-a61dc1bfca7b/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/3d93b8c8-574d-4388-97b4-a61dc1bfca7b?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/3d93b8c8-574d-4388-97b4-a61dc1bfca7b?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/3d93b8c8-574d-4388-97b4-a61dc1bfca7b?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/3d93b8c8-574d-4388-97b4-a61dc1bfca7b)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:1c535b31-c4c3-4192-a3e3-1db06f76c7b9 -->
   
   
   [](1c535b31-c4c3-4192-a3e3-1db06f76c7b9)



##########
loonar/install-docker-rootless.sh:
##########
@@ -0,0 +1,90 @@
+#!/bin/bash
+
+# This script sets up Docker in rootless mode for improved security.
+# Rootless Docker allows a non-root user to run containers without requiring 
elevated privileges,
+# reducing the risk of system compromise in case of container breakout.
+
+set -e
+
+USERNAME="dockeruser"
+DOCKER_INSTALL_URL="https://get.docker.com/rootless";
+
+# Check if the user already exists
+if id "$USERNAME" &>/dev/null; then
+  echo "👤 User $USERNAME already exists. Skipping creation."
+else
+  echo "👤 Creating user $USERNAME..."
+  useradd -m -s /bin/bash "$USERNAME"
+fi
+
+# Check if dependencies are already installed
+REQUIRED_PKGS=(uidmap dbus-user-session curl)
+MISSING_PKGS=()
+for pkg in "${REQUIRED_PKGS[@]}"; do
+  dpkg -s "$pkg" &>/dev/null || MISSING_PKGS+=("$pkg")
+done
+if [ ${#MISSING_PKGS[@]} -eq 0 ]; then
+  echo "📦 Dependencies already installed."
+else
+  echo "📦 Installing dependencies: ${MISSING_PKGS[*]}..."
+  apt update && apt install -y "${MISSING_PKGS[@]}"
+fi
+
+# Check if rootless Docker is already installed
+if sudo -u "$USERNAME" test -x 
"/home/$USERNAME/bin/dockerd-rootless-setuptool.sh"; then
+  echo "🐳 Rootless Docker already installed for $USERNAME."
+else
+  echo "🐳 Installing rootless Docker for $USERNAME..."
+  sudo -u "$USERNAME" bash -c "curl -fsSL $DOCKER_INSTALL_URL | sh || true"

Review Comment:
   ### Silent failure in Docker installation <sub>![category Error 
Handling](https://img.shields.io/badge/Error%20Handling-ea580c)</sub>
   
   <details>
     <summary>Tell me more</summary>
   
   ###### What is the issue?
   The '|| true' silently ignores any installation failures, which could lead 
to an incomplete or failed Docker installation without proper error 
notification.
   
   ###### Why this matters
   The script will continue executing even if the Docker installation fails, 
potentially causing issues in subsequent steps that depend on a successful 
installation.
   
   ###### Suggested change ∙ *Feature Preview*
   Remove the '|| true' and add proper error handling:
   ```bash
   if ! sudo -u "$USERNAME" bash -c "curl -fsSL $DOCKER_INSTALL_URL | sh"; then
       echo "❌ Docker installation failed"
       exit 1
   fi
   ```
   
   
   ###### Provide feedback to improve future suggestions
   [![Nice 
Catch](https://img.shields.io/badge/👍%20Nice%20Catch-71BC78)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9245104e-59fd-4574-80f8-26fbfb43c277/upvote)
 
[![Incorrect](https://img.shields.io/badge/👎%20Incorrect-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9245104e-59fd-4574-80f8-26fbfb43c277?what_not_true=true)
  [![Not in 
Scope](https://img.shields.io/badge/👎%20Out%20of%20PR%20scope-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9245104e-59fd-4574-80f8-26fbfb43c277?what_out_of_scope=true)
 [![Not in coding 
standard](https://img.shields.io/badge/👎%20Not%20in%20our%20standards-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9245104e-59fd-4574-80f8-26fbfb43c277?what_not_in_standard=true)
 
[![Other](https://img.shields.io/badge/👎%20Other-white)](https://app.korbit.ai/feedback/aa91ff46-6083-4491-9416-b83dd1994b51/9245104e-59fd-4574-80f8-26fbfb43c277)
   </details>
   
   <sub>
   
   💬 Looking for more details? Reply to this comment to chat with Korbit.
   </sub>
   
   <!--- korbi internal id:2e3e531c-8457-4825-a418-a68eedfeb34b -->
   
   
   [](2e3e531c-8457-4825-a418-a68eedfeb34b)



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]


---------------------------------------------------------------------
To unsubscribe, e-mail: [email protected]
For additional commands, e-mail: [email protected]

Reply via email to