ot-recorder should not run as root about docker-recorder

[jpmens]

Thanks for your suggestion. Why do we need a dedicated user/group on the host system? I don't think this is required.

We'll gladly entertain a pull-request which implements this.

[marcopaganini]

The reason is that it appears volumes can only be mounted as root. Without volumes, the only other solution is to map something in the host filesystem. For that, you'd need a host user/group.

…

On Mon, Mar 9, 2020 at 9:56 AM JP Mens ***@***.***> wrote: Thanks for your suggestion. Why do we need a dedicated user/group on the host system? I don't think this is required. We'll gladly entertain a pull-request which implements this. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#32?email_source=notifications&email_token=ABYUYBGF4KLOYX7W6IQAYMDRGUNTLA5CNFSM4K7CCS52YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOEOICUBQ#issuecomment-596650502>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ABYUYBFW6JWSJXNZLHTGXGLRGUNTLANCNFSM4K7CCS5Q> .

[jpmens]

It is clearly visible that I'm not a Docker specialist, but I cannot imagine requring a host user/group.

In fact this page suggests it's not required, at least that's how I understand it:

FROM <base image>
RUN groupadd -g 999 appuser && \
    useradd -r -u 999 -g appuser appuser
USER appuser

From here onwards, our Recorder would run as user appuser, and I think that sounds like what you are asking for.

Are you able to test this, to make sure permissions on the data volume don't need changing?

That same link, btw, explains it is possible to voluntarily launch the container as non-root.

[marcopaganini]

Oh, I'm far from a docker specialist myself. :)

I don't believe your suggestion would work because it seems docker always mounts volumes as root.

See this example:

$ cat Dockerfile
FROM debian
RUN groupadd -g 999 appuser && \
    useradd -r -u 999 -g appuser appuser
USER appuser

$ docker build -t voltest:latest .
Sending build context to Docker daemon  2.048kB
Step 1/3 : FROM debian
 ---> 971452c94376
Step 2/3 : RUN groupadd -g 999 appuser &&     useradd -r -u 999 -g appuser appuser
 ---> Using cache
 ---> c0991713bdaf
Step 3/3 : USER appuser
 ---> Using cache
 ---> d325f2b5d689
Successfully built d325f2b5d689
Successfully tagged voltest:latest

$ docker volume create foobar
foobar

$ docker run -it --rm -v foobar:/foobar voltest
appuser@e1edf851f736:/$ ls -ltrd /foobar
drwxr-xr-x 2 root root 4096 Mar 12 04:03 /foobar

appuser@e1edf851f736:/$ id
uid=999(appuser) gid=999(appuser) groups=999(appuser)

As we can see, even when we specify a user, docker seems to always mount the volume as root (which is weird, but docker is weird.) The instructions I originally wrote work around this by mounting a directory on the host machine (which is not as nice as a clean volume), but require no modifications to Dockerfile.

If you're open to the idea of patches to the Dockerfile, we can create the appuser command above (with an ID in an env var, defaulting to 999) and upon execution chmod the mounted directory to that user, downgrade privileges and then run ot-recorder with that user.

Would that be an acceptable solution to you?