Does the container have to run as root?

[Qhilm]

I added user: 1234:100 to the docker compose and I see this error in the docker logs: "You must be root to run this script."

I normally avoid running containers as root for security reasons.

[edit] I did check that user 1234 has write permissions to the volumes I'm mounting. In fact, in the same stack, I have another container running using the same user, mounting volumes from the same directory without issue.

[caronc]

The startup script aligns nginx and other configurations dynamically based on what you provided it (requires root). The script then sets up directories internally which require the root permission also. Then, when the script finishes, it's services run at the user you told it to (not root). You can verify this with ps to see the processes running in memory.

[caronc]

# for your example, perhaps this is what you want to set:
docker run --name apprise \
   -p 8000:8000 \
   -e PUID=1234 \
   -e PGID=100 \
   -v /path/to/local/config:/config \
   -v /path/to/local/plugin:/plugin \
   -v /path/to/local/attach:/attach \
   -e APPRISE_STATEFUL_MODE=simple \
   -e APPRISE_WORKER_COUNT=1 \
   -d caronc/apprise:latest

Setting the PUID and PGID to the values you want make sure all of the processes inside the container correctly run as what you set it to. It also make sure all root processes change to this user setting. In addition to this, the directories that are set up are also prepared to be accessible by this user permission as well.

[Qhilm]

thanks. I am not very concerned about the application inside the container, it can run as whatever user. What I would like to is to control the user the container itself runs as.

But if I run

docker run --name apprise\
   -u 1234:100 \
   -p 8000:8000 \
   -e PUID=1234 \
   -e PGID=100 \
   -v /path/to/local/config:/config \
   -v /path/to/local/plugin:/plugin \
   -v /path/to/local/attach:/attach \
   -e APPRISE_STATEFUL_MODE=simple \
   -e APPRISE_WORKER_COUNT=1 \
   -d caronc/apprise:latest

I run into the error "You must be root to run this script."

Hence I assume root is required for the container itself?

[caronc]

I'll need to investigate; i mean times are always changing, but it was always my understanding that a docker container must require root at the start. You can grant yourself the ability to run it as root with:

# Add yourself to the docker group:
sudo usermod -aG docker $(whoami)
# you will have to log out and back in again for these new access controls to take effect

Then you can run the command above and it should launch the container as a root user. The container itself needs root to set up the filesystems, permissions, and then it downgrades its root elevation to just be that of what you provided it.

When I run the same command above in my environment, it works fine (I don't get the error you're seeing). So I'm not quite sure what the difference is between our environments is. what does which docker return for you? Maybe you're not using the actual binary, but a script that wraps it?

[Qhilm]

When I run the same command above in my environment, it works fine

ok, strange, then it's something about my (ancient) environment then:

• DSM 7.2
• Docker 20.10.2
• Docker Compose 2.9.0

root@machine:~# which docker
/usr/local/bin/docker

In theory, there seem to be a way to work around this issue, using remapping and subordinate user and group IDs.

Seems actually nifty, because it fixes the problem once and for all on all containers.

But that's all theory. If I find the time to test this, I'll report back here.

[caronc]

Try checking out the latest :edge release; I belive i resolved your issue here: #238