When using Geodesic, I get these errors all the time whenever I start up a new shell and do a terraform init or atmos command:

Could not download module "account" (providers.mixin.tf:13) source code from "git::https://github.com/cloudposse/terraform-yaml-stack-config?ref=0.22.3": error

│ downloading 'https://github.com/cloudposse/terraform-yaml-stack-config?ref=0.22.3': /usr/bin/git exited with 128: fatal: detected dubious ownership in repository at

│ To add an exception for this directory, call:

│

│ git config --global --add safe.directory /blahblahblah

Is there a suggested way of dealing with this? I'm adding

git config --global --add safe.directory \*

to my

~/.geodesic/overrides.d/main.sh

but wondering if there is a better avenue there.

You should convert your modules to registry syntax.

module "stack-config" {
  source  = "cloudposse/stack-config/yaml"
  version = "0.22.3"
}

Huh. That is coming from the registry syntax:

module "account" {
  source  = "cloudposse/stack-config/yaml//modules/remote-state"
  version = "0.22.3"

  component = "account-map"
  stage     = "root"

  context = module.this.context
}

Inside Geodesic everything should appear to be owned by root:

⨠ ls -l .terraform*
-rw-r--r-- 1 root root 1043 Feb 20 08:58 .terraform.lock.hcl

.terraform:
total 4
drwxr-xr-x 4 root root 4096 Feb 20 21:01 e98s/

Hm... we're not doing anything special that I know of. I'm only referring to the

/localhost/****

volume mount that is owned by "501" (never seen that) and the group "dialout".

If you are using BindFS because of not running Docker in rootless mode, you may need to upgrade to Geodesic 2.8.1 or later. See PR 901

Just rebuilt our image using Geodesic 2.9.1 Debian. Still hitting the same issue. I'm running colima and not docker desktop though, so that may have something to do with it.

Yes, colima is not supported

Well, I'm not necessarily hitting the same issue, but if I check the owner of a file in

/localhost/***

then I get the following:

What you are seeing is a failure to map UID and GID from host to container. I expect you are using a Mac because the default UID:GID on Mac is 501:20

Yeah, host is mac. I'll check it out.

If you are still using our wrapper to launch Geodesic, you might have success with

export GEODESIC_HOST_BINDFS_ENABLED=true

from the host before launching.

Yeah finding the same thing, it seems to be a problem with the default which is

sshfs

. Will try out your suggestion next time I sit down to my machine.

Here is just one of many issues with VirtioFS and Docker Desktop for Mac. You may run into the same kinds of things with Colima.

Orbstack has good results as well on Mac

@Hans D Thanks for mentioning Orbstack. Potential users should beware that Orbstack will destroy Time Machine backups and effectively prevent other backups if the destination drive is not APFS formatted (such as an HFS+ drive or NAS), unless its data file is immediately excluded from backups. Several people have been affected. For example, pjv .

@Jeremy G (Cloud Posse) running coliam with VirtioFS did the trick for correct file permissions. All files are now owned by

root

. I am launching Geodesic via the wrapper script.

@Matt Gowie Glad that worked. Would you please add a relevant comment to https://github.com/cloudposse/geodesic/issues/594 for other Colima users. I might update the issue title to be more comprehensive about file ownership issues.

Done 👍 Thanks for the pointers + help Jeremy 🤝

You're welcome, and thank you for all your support for Cloud Posse open source.