Get RUN_AS_DEVIN working with app sandbox

[xingyaoww]

The reason why RUN_AS_DEVIN was not working properly is that SANDBOX_USER_ID is not properly setted up. os.getpid() from the app container will return UID=0, which creates the issue of #936.

This PR fix:

• Allowing RUN_AS_DEVIN with app container. The caveat is that the user need to pass-in their UID when starting the app container. I have updated the readme accordingly

docker run \
    -e LLM_API_KEY \
    -e WORKSPACE_MOUNT_PATH=$WORKSPACE_BASE \
    -v $WORKSPACE_BASE:/opt/workspace_base \
    -e SANDBOX_USER_ID=$(id -u) \
    -v /var/run/docker.sock:/var/run/docker.sock \
    -p 4000:3000 \
    --add-host host.docker.internal=host-gateway \
    ghcr.io/opendevin/opendevin:latest

• Make SANDBOX_USER_ID consistent: the app will run with a user with UID of SANDBOX_USER_ID, which won't cause a permission issue in writing to workspace; the sandbox will run with a UID of SANDBOX_USER_ID as well.

[li-boxuan]

Seems integration tests have captured a bug?https://github.com/OpenDevin/OpenDevin/actions/runs/8866160837/job/24343257827?pr=1426#step:6:66:

chmod: changing permissions of 'hello.sh': Operation not permitted

[xingyaoww]

Good catch! Seems like a mounting issue, already pushed a fix see if we can pass that
moby/moby#2259 (comment)

[rbren]

I think I get why this is necessary--we have to plumb the user's ID into both the app container and the sandbox to keep file ownership/permissions consistent. It's a lot to manage but I can't think of a better solution :/

The networking stuff here is what concerns me most though--I definitely don't think we should be changing permissions on docker.sock

[codecov-commenter]

Codecov Report

Attention: Patch coverage is 66.66667% with 2 lines in your changes are missing coverage. Please review.

❗ No coverage uploaded for pull request base (main@31c1a2d). Click here to learn what that means.

❗ Current head b4d74c6 differs from pull request most recent head ec8e5ca. Consider uploading reports for the commit ec8e5ca to get more accurate results

Files	Patch %	Lines
opendevin/sandbox/docker/ssh_box.py	66.66%	2 Missing ⚠️

❗ Your organization needs to install the Codecov GitHub app to enable full functionality.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1426   +/-   ##
=======================================
  Coverage        ?   58.46%           
=======================================
  Files           ?       82           
  Lines           ?     3431           
  Branches        ?        0           
=======================================
  Hits            ?     2006           
  Misses          ?     1425           
  Partials        ?        0           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[rbren]

we really need to fix the underlying issue here 😅

[rbren]

Thanks for doing this!