0

If I use the --user argument of docker run, changes (like a simple mkdir for example) will appear as if performed by that (non-root) user. However, I won't be able to run commands like apt inside the container then, because they require root privileges. By default, there is no pre-installed sudo in debian or ubuntu Docker images.

What's an elegant way to overcome this issue?

0

If you know when and where the changes will be written, you could just use chown on those files afterwards:

  • Pass user and group ID (id -u, id -g) of the host (non-root) user to the Docker container with the --env argument
  • Run your commands/script (inside the container) as root
  • Finally, run chown (also still inside the container) to make the changes look like they've been performed by the host user
  • I have been using this solution, but now I'm accessing the mounted volume both from the container and the host at the same time (when the container is still running) so I don't know when a new file has been created and it would also be some work to find out which files have been created. – finefoot Nov 19 '19 at 19:22
0

I don't think, this is a particularly elegant solution, but it's possible to create a dummy user inside the container whose user and group ID match those of the (non-root) host user:

  • Pass user and group ID (id -u, id -g) of the host (non-root) user to the Docker container with the --env argument
  • Create a new group matching the group ID of the host (non-root) user

    addgroup --gid $DUMMY_GID dummy
    
  • Create a new user matching the user ID of the host (non-root) user

    adduser --uid $DUMMY_UID --gid $DUMMY_GID --disabled-password --gecos "" dummy
    
  • Commands which require root privileges will work

  • Run your other commands/script with runuser

    runuser -u dummy -- command
    
  • Came up with this one as a workaround... I don't think it's a good solution though, is it? There has to be a better way – finefoot Nov 19 '19 at 19:24

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.