Use consistent Docker user names

[dhruvkb]

Problem

Our services use an interesting mix of usernames for users created inside Docker.

Service	Username
api	opener
ingestion_server	ingestionu
catalog	airflow

Description

We should use the same, or a similar format of, names for these users.

[sarayourfriend]

@krysal Can you add more details about how to do this/what it will take to do? It's labelled good first issue now but I'm not sure I would know where to start 😅. I kind of assume there would be complications with this too 🤔

[tejaswarathe]

@dhruvkb Does a naming scheme like apiuser, ingestionuser, airflowuser?

Does the below change look good or do we need to check more impact?

RUN useradd --create-home apiuser \
  && chown -R apiuser /static
USER apiuser

COPY --chown=apiuser --from=packages openverse-attribution /packages/python/openverse-attribution/

COPY --chown=apiuser . /api/

[dhruvkb]

@tejaswarathe I think a naming scheme of service + "_user" would be a good place to start.

After changing a name, do a search in the entire codebase (git grep) to see if that username appears anywhere else in the repo. That will give you an idea of where else it has been used.

One more way to check and be more confident in the change would be to open a PR with your changes. That would let our CI + CD job check everything and determine if everything is working normally.

[sarayourfriend]

What is the utility in using a different username per service? Wouldn't that complicate scripts using docker compose exec?

[dhruvkb]

That's true @sarayourfriend and I agree. I was recommending different usernames because it's closer to what's currently happening. We're already setting the DC_USER env var in the justfiles for the API and the catalog so it would be a matter of finding-and-replacing the username for both of those services.

@tejaswarathe maybe just using the same username everywhere might be better, something like "ov_user" maybe? "opener" is too informal and is a name we use to refer to ourselves so not ideal for a container username.