fix: set MagicDir to tempdir when performing cache probe (#48)

* fix: set MagicDir to tempdir when performing cache probe

* chore: update envbuilder to b7781d8

* imgutil: get default envbuilder binary path from envbuilder options

internal/imgutil/imgutil.go

@@ -7,8 +7,9 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"strings"
 
-	"github.com/coder/envbuilder/constants"
+	eboptions "github.com/coder/envbuilder/options"
 	"github.com/google/go-containerregistry/pkg/authn"
 	"github.com/google/go-containerregistry/pkg/name"
 	v1 "github.com/google/go-containerregistry/pkg/v1"
@@ -34,7 +35,9 @@ func GetRemoteImage(imgRef string) (v1.Image, error) {
 // ExtractEnvbuilderFromImage reads the image located at imgRef and extracts
 // MagicBinaryLocation to destPath.
 func ExtractEnvbuilderFromImage(ctx context.Context, imgRef, destPath string) error {
-	needle := filepath.Clean(constants.MagicBinaryLocation)[1:] // skip leading '/'
+	var o eboptions.Options
+	o.SetDefaults()
+	needle := strings.TrimPrefix(o.BinaryPath, "/")
 	img, err := GetRemoteImage(imgRef)
 	if err != nil {
 		return fmt.Errorf("check remote image: %w", err)

internal/provider/cached_image_resource.go

@@ -10,7 +10,6 @@ import (
 
 	kconfig "github.com/GoogleContainerTools/kaniko/pkg/config"
 	"github.com/coder/envbuilder"
-	"github.com/coder/envbuilder/constants"
 	eboptions "github.com/coder/envbuilder/options"
 	"github.com/coder/terraform-provider-envbuilder/internal/imgutil"
 	"github.com/coder/terraform-provider-envbuilder/internal/tfutil"
@@ -455,7 +454,7 @@ func runCacheProbe(ctx context.Context, builderImage string, opts eboptions.Opti
 	}()
 
 	oldKanikoDir := kconfig.KanikoDir
-	tmpKanikoDir := filepath.Join(tmpDir, constants.MagicDir)
+	tmpKanikoDir := filepath.Join(tmpDir, ".envbuilder")
 	// Normally you would set the KANIKO_DIR environment variable, but we are importing kaniko directly.
 	kconfig.KanikoDir = tmpKanikoDir
 	tflog.Info(ctx, "set kaniko dir to "+tmpKanikoDir)
@@ -467,6 +466,8 @@ func runCacheProbe(ctx context.Context, builderImage string, opts eboptions.Opti
 	if err := os.MkdirAll(tmpKanikoDir, 0o755); err != nil {
 		return nil, fmt.Errorf("failed to create kaniko dir: %w", err)
 	}
+	// Use the temporary directory as our 'magic dir'.
+	opts.MagicDirBase = tmpKanikoDir
 
 	// In order to correctly reproduce the final layer of the cached image, we
 	// need the envbuilder binary used to originally build the image!
@@ -496,13 +497,6 @@ func runCacheProbe(ctx context.Context, builderImage string, opts eboptions.Opti
 		tflog.Debug(ctx, "workspace_folder not specified, using temp dir", map[string]any{"workspace_folder": opts.WorkspaceFolder})
 	}
 
-	// We need a place to clone the repo.
-	repoDir := filepath.Join(tmpDir, "repo")
-	if err := os.MkdirAll(repoDir, 0o755); err != nil {
-		return nil, fmt.Errorf("failed to create repo dir: %w", err)
-	}
-	opts.RemoteRepoDir = repoDir
-
 	// The below options are not relevant and are set to their zero value
 	// explicitly.
 	// They must be set by extra_env to be used in the final builder image.

internal/provider/cached_image_resource_test.go

@@ -46,6 +46,7 @@ func TestAccCachedImageResource(t *testing.T) {
 						"CODER_AGENT_TOKEN", "some-token",
 						"CODER_AGENT_URL", "https://coder.example.com",
 						"ENVBUILDER_CACHE_REPO", deps.CacheRepo,
+						"ENVBUILDER_DOCKER_CONFIG_BASE64", deps.DockerConfigBase64,
 						"ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH", deps.Repo.Key,
 						"ENVBUILDER_GIT_URL", deps.Repo.URL,
 						"ENVBUILDER_REMOTE_REPO_BUILD_MODE", "true",
@@ -78,6 +79,7 @@ RUN date > /date.txt`,
 						"CODER_AGENT_TOKEN", "some-token",
 						"CODER_AGENT_URL", "https://coder.example.com",
 						"ENVBUILDER_CACHE_REPO", deps.CacheRepo,
+						"ENVBUILDER_DOCKER_CONFIG_BASE64", deps.DockerConfigBase64,
 						"ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH", deps.Repo.Key,
 						"ENVBUILDER_GIT_URL", deps.Repo.URL,
 						"ENVBUILDER_REMOTE_REPO_BUILD_MODE", "true",
@@ -88,9 +90,8 @@ RUN date > /date.txt`,
 			},
 		},
 		{
-			// This test case ensures that parameters passed via extra_env are
-			// handled correctly.
-			name: "extra_env",
+			// This test case ensures that overriding the devcontainer directory works.
+			name: "different_dir",
 			files: map[string]string{
 				"path/to/.devcontainer/devcontainer.json": `{"build": { "dockerfile": "Dockerfile" }}`,
 				"path/to/.devcontainer/Dockerfile": `FROM localhost:5000/test-ubuntu:latest
@@ -115,6 +116,7 @@ RUN date > /date.txt`,
 						"ENVBUILDER_DEVCONTAINER_DIR", "path/to/.devcontainer",
 						"ENVBUILDER_DEVCONTAINER_JSON_PATH", "path/to/.devcontainer/devcontainer.json",
 						"ENVBUILDER_DOCKERFILE_PATH", "path/to/.devcontainer/Dockerfile",
+						"ENVBUILDER_DOCKER_CONFIG_BASE64", deps.DockerConfigBase64,
 						"ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH", deps.Repo.Key,
 						"ENVBUILDER_GIT_URL", deps.Repo.URL,
 						"ENVBUILDER_REMOTE_REPO_BUILD_MODE", "true",
@@ -149,6 +151,7 @@ RUN date > /date.txt`,
 						"CODER_AGENT_URL", "https://coder.example.com",
 						"ENVBUILDER_CACHE_REPO", deps.CacheRepo,
 						"ENVBUILDER_DOCKERFILE_PATH", "Dockerfile",
+						"ENVBUILDER_DOCKER_CONFIG_BASE64", deps.DockerConfigBase64,
 						"ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH", deps.Repo.Key,
 						"ENVBUILDER_GIT_URL", deps.Repo.URL,
 						"ENVBUILDER_REMOTE_REPO_BUILD_MODE", "true",

internal/provider/provider_internal_test.go

@@ -272,7 +272,6 @@ func Test_computeEnvFromOptions(t *testing.T) {
 				PostStartScriptPath:  "string",
 				PushImage:            true,
 				RemoteRepoBuildMode:  true,
-				RemoteRepoDir:        "string",
 				SetupScript:          "string",
 				SkipRebuild:          true,
 				SSLCertBase64:        "string",
@@ -314,7 +313,6 @@ func Test_computeEnvFromOptions(t *testing.T) {
 				"ENVBUILDER_POST_START_SCRIPT_PATH":   "string",
 				"ENVBUILDER_PUSH_IMAGE":               "true",
 				"ENVBUILDER_REMOTE_REPO_BUILD_MODE":   "true",
-				"ENVBUILDER_REMOTE_REPO_DIR":          "string",
 				"ENVBUILDER_SETUP_SCRIPT":             "string",
 				"ENVBUILDER_SKIP_REBUILD":             "true",
 				"ENVBUILDER_SSL_CERT_BASE64":          "string",

internal/provider/provider_test.go

@@ -3,6 +3,7 @@ package provider
 import (
 	"bufio"
 	"context"
+	"encoding/base64"
 	"fmt"
 	"io"
 	"os"
@@ -35,10 +36,11 @@ var testAccProtoV6ProviderFactories = map[string]func() (tfprotov6.ProviderServe
 
 // testDependencies contain information about stuff the test depends on.
 type testDependencies struct {
-	BuilderImage string
-	CacheRepo    string
-	ExtraEnv     map[string]string
-	Repo         testGitRepoSSH
+	BuilderImage       string
+	CacheRepo          string
+	DockerConfigBase64 string
+	ExtraEnv           map[string]string
+	Repo               testGitRepoSSH
 }
 
 // Config generates a valid Terraform config file from the dependencies.
@@ -47,8 +49,9 @@ func (d *testDependencies) Config(t testing.TB) string {
 
 	tpl := `provider envbuilder {}
 resource "envbuilder_cached_image" "test" {
-  builder_image            = {{ quote .BuilderImage }}
+  builder_image              = {{ quote .BuilderImage }}
 	cache_repo               = {{ quote .CacheRepo }}
+	docker_config_base64     = {{ quote .DockerConfigBase64 }}
 	git_url                  = {{ quote .Repo.URL }}
 	extra_env                = {
 		"ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH": {{ quote .Repo.Key }}
@@ -78,19 +81,29 @@ func setup(ctx context.Context, t testing.TB, extraEnv, files map[string]string)
 	envbuilderVersion := getEnvOrDefault("ENVBUILDER_VERSION", "latest")
 	envbuilderImageRef := envbuilderImage + ":" + envbuilderVersion
 
-	// TODO: envbuilder creates /.envbuilder/bin/envbuilder owned by root:root which we are unable to clean up.
-	// This causes tests to fail.
+	testUsername := "testuser"
+	testPassword := "testpassword"
+	testAuthBase64 := base64.URLEncoding.EncodeToString([]byte(fmt.Sprintf("%s:%s", testUsername, testPassword)))
 	regDir := t.TempDir()
-	reg := registrytest.New(t, regDir)
+	reg := registrytest.New(t, regDir, registrytest.BasicAuthMW(t, testUsername, testPassword))
 
 	repoDir := setupGitRepo(t, files)
 	gitRepo := serveGitRepoSSH(ctx, t, repoDir)
+	dockerConfigJSON := fmt.Sprintf(`{
+		"auths": {
+			"%s": {
+				"auth": "%s",
+			}
+		}
+	}`, reg, testAuthBase64)
+	dockerConfigJSONBase64 := base64.StdEncoding.EncodeToString([]byte(dockerConfigJSON))
 
 	return testDependencies{
-		BuilderImage: envbuilderImageRef,
-		CacheRepo:    reg + "/test",
-		ExtraEnv:     extraEnv,
-		Repo:         gitRepo,
+		BuilderImage:       envbuilderImageRef,
+		CacheRepo:          reg + "/test",
+		ExtraEnv:           extraEnv,
+		Repo:               gitRepo,
+		DockerConfigBase64: dockerConfigJSONBase64,
 	}
 }
 
@@ -115,6 +128,7 @@ func seedCache(ctx context.Context, t testing.TB, deps testDependencies) {
 		"ENVBUILDER_VERBOSE":                  "true",
 		"ENVBUILDER_GIT_URL":                  deps.Repo.URL,
 		"ENVBUILDER_GIT_SSH_PRIVATE_KEY_PATH": "/id_ed25519",
+		"ENVBUILDER_DOCKER_CONFIG_BASE64":     deps.DockerConfigBase64,
 	}
 
 	for k, v := range deps.ExtraEnv {