Workaround for bind-mounting and running as root inside container
Hello, There may not be a good answer to this question, but I was wondering if anyone has a suggestion. I'm using rootless podman for local development environments for Node.js and PHP projects. I can't wait to rebuild an image after each file is changed, so I'm bind mounting my project's working directory into the container so changes are reflected instantly. A consequence of this is that all of the project files are owned by the root user inside the container (since they are owned by my regular user outside). This means that I need to run any commands as root in the container in order to have access to the project files. That, in itself, is not a big deal. The problem is that a lot of software doesn't like to be run as root. I have run into problems with: - PHP-FPM requires a special flag to run as root and config changes - WP-CLI requires a special flag added to any command to run as root - Compiling software can fail as part of npm install (specifically with gulp-imagemin) None of these issues are really show stoppers, but they do slow down development, and each time I run into a new one it can take time to debug. Are there any workarounds that allow for fast development, the user running in the container to not be root, and reasonable security (e.g. I don't really want to chmod 777 all of my project files)? -- Thank you, Dominic
On 2020-09-14 19:30, Dominic wrote:
Hello,
There may not be a good answer to this question, but I was wondering if anyone has a suggestion. I'm using rootless podman for local development environments for Node.js and PHP projects.
I can't wait to rebuild an image after each file is changed, so I'm bind mounting my project's working directory into the container so changes are reflected instantly. A consequence of this is that all of the project files are owned by the root user inside the container (since they are owned by my regular user outside). This means that I need to run any commands as root in the container in order to have access to the project files. That, in itself, is not a big deal. The problem is that a lot of software doesn't like to be run as root. I have run into problems with:
- PHP-FPM requires a special flag to run as root and config changes - WP-CLI requires a special flag added to any command to run as root - Compiling software can fail as part of npm install (specifically with gulp-imagemin)
None of these issues are really show stoppers, but they do slow down development, and each time I run into a new one it can take time to debug.
Are there any workarounds that allow for fast development, the user running in the container to not be root, and reasonable security (e.g. I don't really want to chmod 777 all of my project files)?
-- Thank you, Dominic
Podman features a `--userns=keep-id` flag that will map your user outside the container, to the same UID in the container - so if you could convince PHP-FPM and other applications to run as your UID, you should be able to work with files owned by your user without issue. Thanks, Matt Heon
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
Hi Matt, Thanks for the very helpful response. I had no idea that flag existed. :) It has gotten me most of the way there, but since I also use some named volumes I think I'm being bitten by this bug (but I'm not sure): https://github.com/containers/podman/issues/5698 My UID on the host is 1000 and there is also a user in the container with the same UID. This works fine since I want to run as that user anyway. The problem comes when that user needs to write some files to their home directory (this happens when I run npm install). I have mounted a named volume at the user's home directory which has some files that I need to be there. However, when I do that the user's home directory is now owned by UID 999 and GID 999 instead of 1000. It looks like a fix for the issue above has been merged but not included in a stable release yet (I'm on 2.0.6). I'm not even sure if it will address this problem though. To sum up, I need some files from a named volume in the user's home directory, but when I use --userns=keep-id, the ownership of the home directory gets changed. Hopefully that makes sense, and as soon as the fix for #5698 is released I'll test again to see if that solves it. Thanks, Dominic Matt Heon <mheon@redhat.com> wrote:
Hello,
There may not be a good answer to this question, but I was wondering if anyone has a suggestion. I'm using rootless
On 2020-09-14 19:30, Dominic wrote: podman >for local development environments for Node.js and PHP projects.
I can't wait to rebuild an image after each file is changed,
container so changes are reflected instantly. A consequence of this is that all of the project files are owned by the root user >inside the container (since they are owned by my regular user >outside). This means that I need to run any commands as root in >the container in order to have access to the project files. That, >in itself, is not a big deal. The problem is that a lot of >software doesn't like to be run as root. I have run into problems >with:
- PHP-FPM requires a special flag to run as root and config changes - WP-CLI requires a special flag added to any command to run as root - Compiling software can fail as part of npm install (specifically with gulp-imagemin)
None of these issues are really show stoppers, but they do slow >down development, and each time I run into a new one it can take >time to debug.
Are there any workarounds that allow for fast development, the user running in the container to not be root, and reasonable security (e.g. I don't really want to chmod 777 all of my
so >I'm bind mounting my project's working directory into the project >files)?
-- Thank you, Dominic
Podman features a `--userns=keep-id` flag that will map your user outside the container, to the same UID in the container - so if you could convince PHP-FPM and other applications to run as your UID, you should be able to work with files owned by your user without issue.
Thanks, Matt Heon
_______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io _______________________________________________ Podman mailing list -- podman@lists.podman.io To unsubscribe send an email to podman-leave@lists.podman.io
-- Thank you, Dominic
participants (2)
-
Dominic -
Matt Heon