Set docker image username at container creation time?

10,226

Solution 1

The below code has been checked into https://github.com/bmitch3020/run-as-user.

I would handle this in an entrypoint.sh that checks the ownership of /home/myuser and updates the uid/gid of the user inside your container. It can look something like:

#!/bin/sh

set -x
# get uid/gid
USER_UID=`ls -nd /home/myuser | cut -f3 -d' '`
USER_GID=`ls -nd /home/myuser | cut -f4 -d' '`

# get the current uid/gid of myuser
CUR_UID=`getent passwd myuser | cut -f3 -d: || true`
CUR_GID=`getent group myuser | cut -f3 -d: || true`

# if they don't match, adjust
if [ ! -z "$USER_GID" -a "$USER_GID" != "$CUR_GID" ]; then
  groupmod -g ${USER_GID} myuser
fi
if [ ! -z "$USER_UID" -a "$USER_UID" != "$CUR_UID" ]; then
  usermod -u ${USER_UID} myuser
  # fix other permissions
  find / -uid ${CUR_UID} -mount -exec chown ${USER_UID}.${USER_GID} {} \;
fi


# drop access to myuser and run cmd
exec gosu myuser "$@"

And here's some lines from a relevant Dockerfile:

FROM debian:9
ARG GOSU_VERSION=1.10

# run as root, let the entrypoint drop back to myuser
USER root

# install prereq debian packages
RUN apt-get update \
 && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \
     apt-transport-https \
     ca-certificates \
     curl \
     vim \
     wget \
 && apt-get clean \
 && rm -rf /var/lib/apt/lists/*

# Install gosu
RUN dpkgArch="$(dpkg --print-architecture | awk -F- '{ print $NF }')" \
 && wget -O /usr/local/bin/gosu "https://github.com/tianon/gosu/releases/download/$GOSU_VERSION/gosu-$dpkgArch" \
 && chmod 755 /usr/local/bin/gosu \
 && gosu nobody true

RUN useradd -d /home/myuser -m myuser
WORKDIR /home/myuser

# entrypoint is used to update uid/gid and then run the users command
COPY entrypoint.sh /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]
CMD /bin/sh

Then to run it, you just need to mount /home/myuser as a volume and it will adjust permissions in the entrypoint. e.g.:

$ docker build -t run-as-user . 
$ docker run -it --rm -v $(pwd):/home/myuser run-as-user /bin/bash

Inside that container you can run id and ls -l to see that you have access to /home/myuser files.

Solution 2

Usernames are not important. What is important are the uid and gid values.

User myuser inside your container will have a uid of 1000 (first non-root user id). Thus when you start your container and look at the container process from the host machine, you will see that the container is owned by whatever user having a uid of 1000 on the host machine.

You can override this by specifying the user once you run your container using:

docker run --user 1001 ...

Therefore if you want the user inside the container, to be able to access files on the host machine owned by a user having a uid of 1005 say, just run the container using --user 1005.

To better understand how users map between the container and host take a look at this wonderful article. https://medium.com/@mccode/understanding-how-uid-and-gid-work-in-docker-containers-c37a01d01cf

Share:
10,226

Related videos on Youtube

wandadars
Author by

wandadars

Updated on September 20, 2022

Comments

  • wandadars
    wandadars over 1 year

    I have an OpenSuse 42.3 docker image that I've configured to run a code. The image has a single user(other than root) called "myuser" that I create during the initial Image generation via the Dockerfile. I have three script files that generate a container from the image based on what operating system a user is on.

    Question: Can the username "myuser" in the container be set to the username of the user that executes the container generation script?

    My goal is to let a user pop into the container interactively and be able to run the code from within the container. The code is just a single binary that executes and has some IO, so I want the user's directory to be accessible from within the container so that they can navigate to a folder on their machine and run the code to generate output in their filesystem.

    Below is what I have constructed so far. I tried setting the USER environment variable during the linux script's call to docker run, but that didn't change the user from "myuser" to say "bob" (the username on the host machine that started the container). The mounting of the directories seems to work fine. I'm not sure if it is even possible to achieve my goal.

    Linux Container script:

    username="$USER"
    userID="$(id -u)"
    groupID="$(id -g)"
    home="${1:-$HOME}"
    
    imageName="myImage:ImageTag"
    containerName="version1Image"
    
    docker run  -it -d --name ${containerName}  -u $userID:$groupID     \
                -e USER=${username} --workdir="/home/myuser"            \
                --volume="${home}:/home/myuser" ${imageName} /bin/bash  \
    

    Mac Container script:

    username="$USER"
    userID="$(id -u)"
    groupID="$(id -g)"
    home="${1:-$HOME}"
    
    imageName="myImage:ImageTag"
    containerName="version1Image"
    
    docker run  -it -d --name ${containerName}                          \
                --workdir="/home/myuser"            \
                --v="${home}:/home/myuser" ${imageName} /bin/bash  \
    

    Windows Container script:

    ECHO OFF
    SET imageName="myImage:ImageTag"
    SET containerName="version1Image"
    
    docker run -it -d --name %containerName% --workdir="/home/myuser" -v="%USERPROFILE%:/home/myuser" %imageName% /bin/bash
    
    
    echo "Container %containerName% was created."
    echo "Run the ./startWindowsLociStream script to launch container"
    
  • gesellix
    gesellix over 6 years
    That's not for container creation time, but for image build time?
  • wandadars
    wandadars over 6 years
    I don't want to pass build variables during image creation. I just want to align the environment in the container to the environment of the user running the container.