Don't run WP-CLI commands as root #9329

johnbillion · 2025-07-27T11:50:22Z

The WP-CLI container runs as root. Its entrypoint script uses sudo to run commands as the wp_php user, but the entrypoint is bypassed when you use docker compose exec. This is why the --allow-root flag is needed in the docker compose exec commands which are used since r60308.

We can't add user: wp_php to docker-compose.yml because when the container initially starts the entrypoint script still runs but wp_php isn't in the sudoers list and therefore terminates. What we can do is run docker compose exec with the --user wp_php flag and everything is rosey.

Trac ticket: https://core.trac.wordpress.org/ticket/63167
Trac ticket: https://core.trac.wordpress.org/ticket/63564

github-actions · 2025-07-27T12:05:09Z

Test using WordPress Playground

The changes in this pull request can previewed and tested using a WordPress Playground instance.

WordPress Playground is an experimental project that creates a full WordPress instance entirely within the browser.

Some things to be aware of

The Plugin and Theme Directories cannot be accessed within Playground.
All changes will be lost when closing a tab with a Playground instance.
All changes will be lost when refreshing the page.
A fresh instance is created each time the link below is clicked.
Every time this pull request is updated, a new ZIP file containing all changes is created. If changes are not reflected in the Playground instance,
it's possible that the most recent build failed, or has not completed. Check the list of workflow runs to be sure.

For more details about these limitations and more, check out the Limitations page in the WordPress Playground documentation.

Test this pull request with WordPress Playground.

github-actions · 2025-07-27T12:09:29Z

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

Core Committers: Use this line as a base for the props when committing in SVN:

Props johnbillion, westonruter.

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

westonruter · 2025-07-27T23:29:50Z

There is an E2E test failures when I run npm run test:e2e locally:

$ npm run test:e2e

> [email protected] test:e2e
> wp-scripts test-playwright --config tests/e2e/playwright.config.js


Running 25 tests using 1 worker

  ✓  1 [chromium] › tests/e2e/specs/cache-control-headers-directives.test.js:11:6 › Cache Control header directives › No private directive present in cache control when user not logged in. (2.1s)
  ✓  2 [chromium] › tests/e2e/specs/cache-control-headers-directives.test.js:35:6 › Cache Control header directives › Private directive header present in cache control when logged in. (280ms)
  ✓  3 [chromium] › tests/e2e/specs/cache-control-headers-directives.test.js:49:6 › Cache Control header directives › Correct directives present in cache control header when not logged in on 404 page. (526ms)
  ✓  4 [chromium] › tests/e2e/specs/dashboard.test.js:11:6 › Quick Draft › Allows draft to be created with Title and Content (460ms)
  ✓  5 [chromium] › tests/e2e/specs/dashboard.test.js:48:6 › Quick Draft › Allows draft to be created without Title or Content (461ms)
  ✓  6 [chromium] › tests/e2e/specs/edit-posts.test.js:11:6 › Edit Posts › displays a message in the posts table when no posts are present (182ms)
  ✓  7 [chromium] › tests/e2e/specs/edit-posts.test.js:21:6 › Edit Posts › shows a single post after one is published with the correct title (1.2s)
  ✓  8 [chromium] › tests/e2e/specs/edit-posts.test.js:42:6 › Edit Posts › allows an existing post to be edited using the Edit button (2.0s)
  ✓  9 [chromium] › tests/e2e/specs/edit-posts.test.js:72:6 › Edit Posts › allows an existing post to be quick edited using the Quick Edit button (1.4s)
  ✓  10 [chromium] › tests/e2e/specs/edit-posts.test.js:110:6 › Edit Posts › allows an existing post to be deleted using the Trash button (1.3s)
  ✓  11 [chromium] › tests/e2e/specs/empty-trash-restore-trashed-posts.test.js:13:6 › Empty Trash › Empty Trash (1.5s)
  ✓  12 [chromium] › tests/e2e/specs/empty-trash-restore-trashed-posts.test.js:33:6 › Empty Trash › Restore trash post (1.6s)
  ✓  13 [chromium] › tests/e2e/specs/fatal-error-handler.test.js:33:6 › Fatal error handler › should display fatal error notice (63ms)
  ✓  14 [chromium] › tests/e2e/specs/general-settings-invalid-timezone.test.js:7:7 › Settings -> General › Does not allow saving an invalid timezone string with "" (1.1s)
  ✓  15 [chromium] › tests/e2e/specs/general-settings-invalid-timezone.test.js:7:7 › Settings -> General › Does not allow saving an invalid timezone string with "0" (451ms)
  ✓  16 [chromium] › tests/e2e/specs/general-settings-invalid-timezone.test.js:7:7 › Settings -> General › Does not allow saving an invalid timezone string with "Barry/Gary" (438ms)
  ✓  17 [chromium] › tests/e2e/specs/gutenberg-plugin.test.js:25:6 › Gutenberg plugin › should activate (357ms)
  ✓  18 [chromium] › tests/e2e/specs/hello.test.js:7:6 › Hello World › Should load properly (188ms)
  ✘  19 [chromium] › tests/e2e/specs/install.test.js:34:6 › WordPress installation process › should install WordPress with pre-existing database credentials (5.2s)
  ✓  20 [chromium] › tests/e2e/specs/login-localize-script.test.js:45:6 › Localize Script on wp-login.php › should localize script (165ms)
  ✓  21 [chromium] › tests/e2e/specs/maintenance-mode.test.js:27:6 › Maintenance mode › should display maintenance mode page (82ms)
Failed to load resource: the server responded with a status of 503 (Service Unavailable)
  ✓  22 [chromium] › tests/e2e/specs/media-upload.test.js:11:5 › Test dismissing failed upload works correctly (861ms)
  ✓  23 [chromium] › tests/e2e/specs/profile/applications-passwords.test.js:19:6 › Manage applications passwords › should correctly create a new application password (535ms)
  ✓  24 [chromium] › tests/e2e/specs/profile/applications-passwords.test.js:43:6 › Manage applications passwords › should correctly revoke a single application password (521ms)
  ✓  25 [chromium] › tests/e2e/specs/profile/applications-passwords.test.js:66:6 › Manage applications passwords › should correctly revoke all the application passwords (523ms)


  1) [chromium] › tests/e2e/specs/install.test.js:34:6 › WordPress installation process › should install WordPress with pre-existing database credentials 

    Error: should redirect to the installation page

    Timed out 5000ms waiting for expect(locator).toHaveURL(expected)

    Locator: locator(':root')
    Expected pattern: /wp-admin\/install\.php$/
    Received string:  "http://localhost:8889/"
    Call log:
      - should redirect to the installation page with timeout 5000ms
      - waiting for locator(':root')
        9 × locator resolved to <html lang="en-US">…</html>
          - unexpected value "http://localhost:8889/"


      38 |                      page,
      39 |                      'should redirect to the installation page'
    > 40 |              ).toHaveURL( /wp-admin\/install\.php$/ );
         |                ^
      41 |
      42 |              await expect(
      43 |                      page.getByText( /WordPress database error/ ),
        at /Users/westonruter/repos/wordpress-develop/tests/e2e/specs/install.test.js:40:5

    attachment #1: screenshot (image/png) ──────────────────────────────────────────────────────────
    artifacts/test-results/install-WordPress-installa-08866-isting-database-credentials-chromium/test-failed-1.png
    ────────────────────────────────────────────────────────────────────────────────────────────────

    attachment #2: trace (application/zip) ─────────────────────────────────────────────────────────
    artifacts/test-results/install-WordPress-installa-08866-isting-database-credentials-chromium/trace.zip
    Usage:

        npx playwright show-trace artifacts/test-results/install-WordPress-installa-08866-isting-database-credentials-chromium/trace.zip

    ────────────────────────────────────────────────────────────────────────────────────────────────

  1 failed
    [chromium] › tests/e2e/specs/install.test.js:34:6 › WordPress installation process › should install WordPress with pre-existing database credentials 
  24 passed (27.9s)

This is also happening in GHA:

But this is also happening in trunk for me locally. And it was happening in another recently-committed PR: #9318. So this is no better or worse than E2E tests are at present.

westonruter · 2025-07-27T23:33:05Z

I am able to successfully add constants:

 $ npm run env:cli config set FOO BAR --add
npm info using [email protected]
npm info using [email protected]

> [email protected] env:cli
> node ./tools/local-env/scripts/docker.js exec --user wp_php cli wp config set FOO BAR

Success: Added the constant 'FOO' to the 'wp-config.php' file with the value 'BAR'.
npm info ok

johnbillion · 2025-07-28T12:47:48Z

But this is also happening in trunk for me locally.

Yeah it's been there a while now. We've got https://core.trac.wordpress.org/ticket/63024 but no movement so far.

johnbillion · 2025-07-28T12:53:07Z

Committed in r60518.

Don't run WP-CLI commands as root.

2be74ca

johnbillion marked this pull request as ready for review July 27, 2025 12:09

johnbillion requested a review from westonruter July 27, 2025 12:09

westonruter approved these changes Jul 27, 2025

View reviewed changes

johnbillion closed this Jul 28, 2025

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Don't run WP-CLI commands as root #9329

Don't run WP-CLI commands as root #9329

Uh oh!

johnbillion commented Jul 27, 2025 •

edited

Loading

Uh oh!

github-actions bot commented Jul 27, 2025

Uh oh!

github-actions bot commented Jul 27, 2025 •

edited

Loading

Uh oh!

westonruter commented Jul 27, 2025

Uh oh!

westonruter commented Jul 27, 2025

Uh oh!

johnbillion commented Jul 28, 2025

Uh oh!

johnbillion commented Jul 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

Don't run WP-CLI commands as root #9329

Don't run WP-CLI commands as root #9329

Uh oh!

Conversation

johnbillion commented Jul 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions bot commented Jul 27, 2025

Test using WordPress Playground

Some things to be aware of

Uh oh!

github-actions bot commented Jul 27, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

westonruter commented Jul 27, 2025

Uh oh!

westonruter commented Jul 27, 2025

Uh oh!

johnbillion commented Jul 28, 2025

Uh oh!

johnbillion commented Jul 28, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

johnbillion commented Jul 27, 2025 •

edited

Loading

github-actions bot commented Jul 27, 2025 •

edited

Loading