I have a Docker container from which I want to play sound. The container is alpine based, the host is debian based. I try to follow the 'best practice' of not running with root in the container (in fact, I extend an existing 3d party container which already creates and sets a non root user).
To access the sound device(s) in the container I add --device /dev/snd to docker run.
Now the problem is that the non root user in the container can't access /dev/snd (the devices in /dev/snd have uid 0/'root', gid 29/'audio', and permission flags rw-rw----).
Adding the non root user in the container to the 'audio' group doesn't help, because the gid for audio in the container is different (alpine's numbering is different).
As a workaround I have created a new group in the container with gid 29, and name 'audiofix', and assigned that to the user, which works. But that's ugly and fragile as can be :) It relies to much on the gid numbering in the container being stable, and gid 29 being unused in the container (which it was luckily).
So my question is, can anyone suggest a good clean approach for this? I've considered:
- Just run root in the container, I don't like it though because the container is already set up to run as non-root by the 3d party.
- Use the docker 'userns-remap' stuff, but I don't think it fits the problem, and I'm not sure if it's per container or host wide.
- Use a debian based container, which probably has the same gid mapping. But this would make it heavier, and is still kinda fragile, it's not guaranteed the gid's are the same.