File permissions for persistent_volume

[tstescoTT]

Container user must have r/w and host user must have r/w.

Some issues with existing design:

• user may not have sudo access on host
• user host account name may be the same as default user (named user) in container
• using groupadd dockermount and usermod -aG dockermount "$USER" does not immediately take effect, groups are sticky in bash session
• new directories dont always inherit permissions (e.g. if container makes a directory for output)

[tstescoTT]

There were two main options for giving the container read/write access and resolving common issues described above.

option 1: run container with root user

pro:

• container user can r/w all mounted files

con:

• application runs as root, security concerns, not best practice
• new files owned by root, host user cannot write files created by root

option 2: entrypoint.sh script and non-root user for application runtime

• runs entrypoint script with root
  • give non-root user r/w access to shared files
  • chown + chmod shared files
  • then deescalates to non-root and run application

pro:

• runs application using non-root user
• common application pattern
• using shared group allows host and container user to read/write files

con:

• runs container as root initially (then descalates for app)
• need to give each shared directory access by name e.g. for mounting dev files (mitigated but mounting into a single directory CACHE_ROOT).
• extra steps
• container setup takes ~30 seconds longer

examples of this pattern with entrypoint.sh script:

• jenkins official docker iamges:
  https://github.com/jenkinsci/docker/blob/master/debian/bookworm/hotspot/Dockerfile#L149
  https://github.com/jenkinsci/docker/blob/master/jenkins.sh
• gitlab runner
  https://gitlab.com/gitlab-org/gitlab-runner/-/blob/v13.4.1/dockerfiles/runner-helper/Dockerfile#L22
  https://gitlab.com/gitlab-org/gitlab-runner/-/blob/v13.4.1/dockerfiles/runner-helper/helpers/entrypoint
• Nextcloud
  https://github.com/nextcloud/docker/blob/master/docker-entrypoint.sh
  https://github.com/nextcloud/docker/blob/master/30/apache/Dockerfile

[tstescoTT]

Addressed in #78