Docker permissions

[szarnyasg]

The current Docker image puts the output files in the mounted volume as the root user. It is possible (but non-trivial) to work around this problem, see e.g. http://www.inanzzz.com/index.php/post/q1rj/running-docker-container-with-a-non-root-user-and-fixing-shared-volume-permissions-with-dockerfile

[szarnyasg]

This Go library seems to provide an elegant workaround which also works runtime: https://github.com/boxboat/fixuid

Example Dockerfile:

FROM ubuntu:20.04

RUN apt update -y
RUN apt install -y curl

RUN addgroup --gid 1000 docker && \
    adduser --uid 1000 --ingroup docker --home /home/docker --shell /bin/sh --disabled-password --gecos "" docker

RUN USER=docker && \
    GROUP=docker && \
    curl -SsL https://github.com/boxboat/fixuid/releases/download/v0.5/fixuid-0.5-linux-amd64.tar.gz | tar -C /usr/local/bin -xzf - && \
    chown root:root /usr/local/bin/fixuid && \
    chmod 4755 /usr/local/bin/fixuid && \
    mkdir -p /etc/fixuid && \
    printf "user: $USER\ngroup: $GROUP\n" > /etc/fixuid/config.yml

USER docker:docker
ENTRYPOINT ["fixuid"]

Build and mount the working directory:

docker build --rm -t ownership_test_container .
docker run --rm -it -u `id -u`:`id -g` -v $PWD:/home/docker ownership_test_container /bin/bash

[szarnyasg]

Alternative solutions:

• gosu: https://github.com/tianon/gosu, see tutorial
• userns-remap: requires the users to change the Docker configuration
• A workaround using Docker Compose: Best Practices for Non-root User mhart/alpine-node#48 (comment)