Tighten Dockerfile

README.md

@@ -38,7 +38,7 @@ following versions of those related projects:
   [`0260fba168b74dd2504c9447f2fa8da1161ead87`](https://github.com/seL4/seL4/tree/0260fba168b74dd2504c9447f2fa8da1161ead87)
   (on [github.com/seL4/seL4:master](https://github.com/seL4/seL4/tree/master))
 - seL4, when used with Microkit:
-  [`57975d485397ce1744f7163644dd530560d0b7ec`](https://github.com/coliasgroup/seL4/tree/57975d485397ce1744f7163644dd530560d0b7ec)
+  [`57975d485397ce1744f7163644dd530560d0b7ec`](https://github.com/seL4/seL4/tree/57975d485397ce1744f7163644dd530560d0b7ec)
   (on [github.com/seL4/seL4:microkit](https://github.com/seL4/seL4/tree/microkit))
 - seL4 Microkit:
   [`f0939852c62c629346cd3eddbe7d8922eca8530a`](https://github.com/seL4/microkit/tree/f0939852c62c629346cd3eddbe7d8922eca8530a)
@@ -138,7 +138,7 @@ At this repository's top-level directory, build and simulate a simple seL4-based
 task](./crates/examples/root-task/example-root-task) written in Rust (this will take a few minutes):
 
 ```
-make example
+make example # use 'ctrl-a x' to exit the simulation
 ```
 
 Build and run all of this repository's automated tests:

hacking/docker/Dockerfile

@@ -23,39 +23,39 @@ RUN apt-get update && apt-get install -y \
     bash-completion \
     && rm -rf /var/lib/apt/lists/*
 
-RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers # for convenience
+RUN echo '%sudo ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
 
 ARG UID
 ARG GID
 
 RUN set -eux; \
-    if ! [ $UID = 0 -a $GID = 0 ]; then \
-        ! getent passwd $UID; \
-        # NOTE
-        # This is a bit of a hack. For example, GID for "staff" on MacOS is "dialout" on Debian. In
-        # an ideal world, we'd ensure that an already-occupied GID corresponds to either "users" or
-        # "staff" on Debian.
+    if [ $UID -eq 0 ]; then \
+        if [ $GID -ne 0 ]; then \
+            echo "error: \$UID == 0 but \$GID != 0" >&2; \
+            exit 1; \
+        fi; \
+    else \
+        if getent passwd $UID; then \
+            echo "error: \$UID $UID already exists" >&2; \
+            exit 1; \
+        fi; \
         if ! getent group $GID; then \
-            groupadd -g $GID x; \
+            groupadd --gid $GID x; \
         fi; \
-        useradd -u $UID -g $GID -G sudo -m -p x x; \
-    fi
-
-# So that they don't depend on $HOME
-ENV RUSTUP_HOME=/opt/rustup
-ENV CARGO_HOME=/opt/cargo
+        useradd --uid $UID --gid $GID --groups sudo --create-home x; \
+    fi;
 
 RUN set -eux; \
-    dirs="/nix $RUSTUP_HOME $CARGO_HOME"; \
-    mkdir -p -m 0755 $dirs; \
-    chown $UID:$GID $dirs
+    mkdir -p -m 0755 /nix; \
+    chown $UID:$GID /nix;
 
 USER $UID
 
 RUN curl -sSf -L https://sh.rustup.rs | \
         bash -s -- -y --no-modify-path --default-toolchain none
 
-ENV PATH=$CARGO_HOME/bin:$PATH
+# Account for both possible cases
+ENV PATH=/root/x/.cargo/bin:/home/x/.cargo/bin:$PATH
 
 RUN curl -sSf -L https://nixos.org/nix/install | \
         bash -s -- --yes --no-modify-profile --no-channel-add
@@ -68,7 +68,7 @@ RUN set -eux; \
     nix-channel --update; \
     nix-env -i nix-bash-completions; \
     nix-channel --remove nixpkgs; \
-    nix-collect-garbage -d
+    nix-collect-garbage -d;
 
 # Add gcroot for store paths required by this image so that fresh images can use persistent /nix
 # volumes.
@@ -77,7 +77,7 @@ RUN set -eux; \
     . ~/.nix-profile/etc/profile.d/nix.sh; \
     nix-store -r \
         --add-root /nix/var/nix/gcroots-for-image/profile \
-        $(readlink --canonicalize-existing ~/.nix-profile)
+        $(readlink --canonicalize-existing ~/.nix-profile);
 
 COPY nix.conf /etc/nix/