[wanda] Add context_owner spec option and include in cache digest (#481)

Add context_owner field to the wanda Spec, allowing .wanda.yaml files to
specify a "uid:gid" override for all files in the build context tar.
Wire it through resolveBuildInput to set the tarStream owner, and
include it in buildInputCore so changing context_owner invalidates the
cache.

Topic: add-context-owner-spec
Relative: add-context-owner-tar

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Signed-off-by: andrew <andrew@anyscale.com>

Signed-off-by: andrew <andrew@anyscale.com>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: andrew-anyscale

wanda/build_input.go

@@ -76,6 +76,8 @@ type buildInputCore struct {
 
 	Platform string `json:",omitempty"` // "amd64" (empty string) or GOARCH
 	OS       string `json:",omitempty"` // "linux" (empty string) or GOOS
+
+	ContextOwner string `json:",omitempty"` // "uid:gid" override
 }
 
 func (i *buildInput) makeCore(dockerfile string, lookup lookupFunc) (*buildInputCore, error) {

wanda/forge.go

@@ -300,6 +300,14 @@ func (f *Forge) ExtractArtifacts(spec *Spec, imageTag string) error {
 func (f *Forge) resolveBuildInput(spec *Spec) (*buildInput, *buildInputCore, error) {
 	ts := newTarStream()
 
+	if spec.ContextOwner != "" {
+		owner, err := parseContextOwner(spec.ContextOwner)
+		if err != nil {
+			return nil, nil, err
+		}
+		ts.owner = owner
+	}
+
 	files, err := listSrcFiles(f.workDir, spec.Srcs, spec.Dockerfile)
 	if err != nil {
 		return nil, nil, fmt.Errorf("list src files: %w", err)
@@ -321,6 +329,7 @@ func (f *Forge) resolveBuildInput(spec *Spec) (*buildInput, *buildInputCore, err
 		return nil, nil, fmt.Errorf("make build input core: %w", err)
 	}
 	inputCore.Epoch = f.config.Epoch
+	inputCore.ContextOwner = spec.ContextOwner
 
 	return in, inputCore, nil
 }

wanda/spec.go

@@ -31,6 +31,10 @@ type Spec struct {
 
 	// Artifacts defines files and directories to extract from the built image.
 	Artifacts []*Artifact `yaml:"artifacts,omitempty"`
+
+	// ContextOwner overrides the uid:gid for all files and directories
+	// in the build context tar. Format: "uid:gid" (e.g. "2000:100").
+	ContextOwner string `yaml:"context_owner,omitempty"`
 }
 
 func parseSpecFile(f string) (*Spec, error) {
@@ -146,6 +150,7 @@ func (s *Spec) expandVar(lookup lookupFunc) *Spec {
 	result.BuildHintArgs = stringsExpandVar(s.BuildHintArgs, lookup)
 	result.DisableCaching = s.DisableCaching
 	result.Artifacts = artifactsExpandVar(s.Artifacts, lookup)
+	result.ContextOwner = expandVar(s.ContextOwner, lookup)
 
 	return result
 }

wanda/spec_test.go

@@ -88,13 +88,16 @@ func TestSpecExpand(t *testing.T) {
 		BuildHintArgs: []string{
 			"REMOTE_CACHE_URL=$REMOTE_CACHE_URL",
 		},
+		ContextOwner: "$OWNER_UID:$OWNER_GID",
 	}
 
 	envs := map[string]string{
 		"NAME":             "hello",
 		"UBUNTU_VERSION":   "22.04",
 		"RAYCI_BUILDID":    "abc123",
 		"REMOTE_CACHE_URL": "http://localhost:5000",
+		"OWNER_UID":        "1000",
+		"OWNER_GID":        "1000",
 	}
 
 	expanded := spec.expandVar(func(k string) (string, bool) {
@@ -114,6 +117,7 @@ func TestSpecExpand(t *testing.T) {
 		BuildHintArgs: []string{
 			"REMOTE_CACHE_URL=http://localhost:5000",
 		},
+		ContextOwner: "1000:1000",
 	}
 
 	if !reflect.DeepEqual(expanded, want) {