improve self-hosting permission handling#1072
Open
Onatcer wants to merge 4 commits into
Open
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #1072 +/- ##
============================================
+ Coverage 88.63% 88.70% +0.06%
Complexity 1875 1875
============================================
Files 275 275
Lines 9817 9753 -64
============================================
- Hits 8701 8651 -50
+ Misses 1116 1102 -14 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR adds support for remapping UID/GID at runtime to improve the file permission handling on certain systems.
Until now the image only supported UID 1000 in practice. Docker's --user override accepted other UIDs but several writable paths weren't set up for them, causing Laravel to fail on startup. By adding PUID/PGID (which default to 1000:1000) we now allow users to customize the user. This is especially helpful for users on NAS systems (Synology, TrueNAS...) and also Portainer who do not follow the linux convention of having the first non-root user as UID 1000.
To achieve this we start the container as root by default just for the init and then immediately drop to the desired user by the env arguments (or to 1000:1000 by default). This is a common pattern for self-hosting containers.
This change will make sure that containers that are started as a non-root user (because of a user/runAsUser override) will run as this non-root user. If you need to have the container running as root you can set SOLIDTIME_DROP_PRIVILEGES=never
We also check for the bootstrap directories at startup now and make sure they exist, rather than only in the build step. This fixes bind mounts and K8s PVCs with missing directory structure.
TODO:
[] drop the user overrides in the docker compose examples
[] update docs