使用Bazel加载Docker镜像tar包的权限矛盾问题求助

背景信息 #

我使用Bazel构建Docker镜像，采用官方推荐的rules_oci规则，核心依赖oci_tarball规则。执行bazel build可生成Docker可加载的tar包，也能通过bazel run让Bazel自动完成镜像加载操作。

可分别执行bazel build :tarball、docker load -i bazel-bin/tarball/tarball.tar将oci_image目标加载到Docker守护进程。

问题说明 #

目前陷入两难困境，无法成功将镜像tar包加载到Docker：

• 使用bazel run加载tar包时，Docker要求以root用户执行
• Bazel的封闭Python解释器禁止以root用户运行

复现步骤 #

设备为搭载Sonoma 14.5系统的M2芯片Mac，推测Linux设备也会出现相同问题。
可查看仓库首个PR，新增代码大多来自MODULE.bazel.lock文件，可忽略。
通过Homebrew安装Bazelisk，并安装Docker Desktop（可能遗漏部分依赖）。
进入仓库目录，执行bazel run //abacus/genesis:genesis查看非root用户输出，或执行sudo bazel run //abacus/genesis:genesis查看root用户输出。

输出结果 #

非root用户 #

➜  monorepo-alpha git:(jalvarado/poc) bazel run //abacus/genesis:genesis
INFO: Analyzed target //abacus/genesis:genesis (0 packages loaded, 0 targets configured).
INFO: Found 1 target...
Target //abacus/genesis:genesis up-to-date:
  bazel-bin/abacus/genesis/genesis/tarball.spec
INFO: Elapsed time: 0.105s, Critical Path: 0.00s
INFO: 1 process: 1 internal.
INFO: Build completed successfully, 1 total action
INFO: Running command line: bazel-bin/abacus/genesis/genesis.sh
Cannot connect to the Docker daemon at unix:///Users/josalvatorre/.docker/run/docker.sock. Is the docker daemon running?
tar: (null)

root用户 #

➜  monorepo-alpha git:(jalvarado/poc) sudo bazel run //abacus/genesis:genesis
Password:
Extracting Bazel installation...
Starting local Bazel server and connecting to it...
INFO: Repository rules_python~~python~python_3_11_aarch64-apple-darwin instantiated at:
  <builtin>: in <toplevel>
Repository rule python_repository defined at:
  /private/var/tmp/_bazel_root/5ad888b49df0a0d5e008e30fa7c56d14/external/rules_python~/python/repositories.bzl:381:36: in <toplevel>
ERROR: An error occurred during the fetch of repository 'rules_python~~python~python_3_11_aarch64-apple-darwin':
   Traceback (most recent call last):
    File "/private/var/tmp/_bazel_root/5ad888b49df0a0d5e008e30fa7c56d14/external/rules_python~/python/repositories.bzl", line 197, column 25, in _python_repository_impl
        fail("The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.")
Error in fail: The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.
ERROR: <builtin>: fetching python_repository rule //:rules_python~~python~python_3_11_aarch64-apple-darwin: Traceback (most recent call last):
    File "/private/var/tmp/_bazel_root/5ad888b49df0a0d5e008e30fa7c56d14/external/rules_python~/python/repositories.bzl", line 197, column 25, in _python_repository_impl
        fail("The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.")
Error in fail: The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.
ERROR: no such package '@@rules_python~~python~python_3_11_aarch64-apple-darwin//': The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.
ERROR: /private/var/tmp/_bazel_root/5ad888b49df0a0d5e008e30fa7c56d14/external/rules_pkg~/pkg/private/tar/BUILD:49:10: @@rules_pkg~//pkg/private/tar:build_tar depends on @@rules_python~~python~python_3_11_aarch64-apple-darwin//:python_runtimes in repository @@rules_python~~python~python_3_11_aarch64-apple-darwin which failed to fetch. no such package '@@rules_python~~python~python_3_11_aarch64-apple-darwin//': The current user is root, please run as non-root when using the hermetic Python interpreter. See https://github.com/bazelbuild/rules_python/pull/713.
ERROR: Analysis of target '//abacus/genesis:genesis' failed; build aborted: Analysis failed
INFO: Elapsed time: 15.226s, Critical Path: 0.01s
INFO: 1 process: 1 internal.
ERROR: Build did NOT complete successfully
ERROR: Build failed. Not running target

解决方案 #

方案1：拆分构建与加载步骤 #

放弃bazel run一步到位，分两步执行：

1. 以普通用户身份构建tar包：bazel build //abacus/genesis:genesis
2. 用root权限单独执行Docker加载：sudo docker load -i bazel-bin/abacus/genesis/genesis/tarball.tar

方案2：配置Docker允许普通用户访问 #

• Mac系统：检查Docker Desktop是否正在运行，重启终端或Docker确保权限生效
• Linux系统：将当前用户加入docker用户组，执行sudo usermod -aG docker $USER后重新登录，即可无需root访问Docker

方案3：自定义加载脚本 #

在BUILD文件中定义一个sh_binary目标，让构建过程保持普通用户，仅加载环节自动调用sudo：

sh_binary(
    name = "load_genesis",
    srcs = ["load_genesis.sh"],
    data = [":genesis"],
)

load_genesis.sh内容：

#!/bin/bash
sudo docker load -i "$(dirname "$0")/genesis/tarball.tar"

执行时先构建：bazel build //abacus/genesis:load_genesis，再运行：bazel run //abacus/genesis:load_genesis

内容的提问来源于stack exchange，提问作者José Alvarado Torre