Issue: Appsody on Windows: required permissions on ~/AppData

[borazem]

Appsody Stack Validate is failing

Setup:

• Windows 10 with Azure AD with PIN login
• Docker Desktop (with created separate local user DockerHost for Docker Shared Drives)
  -Appsody installation folder: c:\cda\cp4app\Appsody which was added to the User profile path
• I was not creating appsody stacks in the %USERPROFILE%.directory-for-appsody-project but in the c:\cda\cp4app\AppsodyStack with DockerHost assigned full permissions to c:\cda\cp4app and subfolders.

Besides permissions needed for folders specified in the appsody installation guidance (https://appsody.dev/docs/docker-windows-aad/):

• %USERPROFILE%.m2
• %USERPROFILE%.appsody\repository
• %USERPROFILE%.directory-for-appsody-project

I found that appsody stack validation process creates (run) want's to use also the folder: %USERPROFILE%.AppData\Local\Temp

I tried to set the user and system temp and tmp variable to something like c:\temp but selection of the Temp folder seems not related to the temp or tmp variable.

Digging deeper I figured out that the DockerHost account need full permission at the %USERPROFILE%.AppData\Local\Temp. Moreover, assignment of full permissions to this Temp folder is not enough. Based on many tries i figured it out that the %USERPROFILE%.AppData*Local* folder should have minimum "Traverse folder /execute file" and "List folder /read data" for that folder only (not files and subfolders). More interestingly is such permissions were not enough for %USERPROFILE%*.AppData* folder which actually needed Full permissions for the DockerHost account.

While playing around with permissions on AppData is not very smart and I would say also net really recommended could you review and see if this location could be avoid and used some more appropriate temporary location.

###########################

In addition, all the commands provided (or appsody-setup.bat file in within the appsody installation packate) are for windows cmd command prompt, while I thing PowerShell command prompt suppose to be more native to Docker Desktop. Hence, the commands more friendly to PowerShell where variable form like %VARIABLE% are not supported.

for creating variables instead of set VARIABLE=something perhaps [System.Environment]::SetEnvironmentVariable('VARIABLE', 'something' , 'User') for User or [System.Environment]::SetEnvironmentVariable('VARIABLE', 'something' , 'Machine') for System variable could be used
and
[System.Environment]::SetEnvironmentVariable('Path',$([System.Environment]::GetEnvironmentVariable('Path','User')+ $pwd +'\;'), 'User') for appending current folder to the User environment path variable.

for creating folder in the user profile, instead of: mkdir "%USERPROFILE%\.appsody\repository" the
mkdir "$Env:USERPROFILE/.appsody/repository" could be considered

or for assigning for assigning permissions Instead of:
icacls "%USERPROFILE%\.appsody" /grant %DOCKER_SHARED_DRIVE_USER%:(OI)(CI)F perhaps
icacls "$Env:USERPROFILE/.appsody" /grant "DockerHost:(OI)(CI)F" would make sense in the PowerShell command prompt.

[tnixa]

The first part of this was fixed with appsody issue...
appsody/appsody#831

The power shell suggestions can be handled via a new feature request