Instructions to run in rootless containers

[leleogere]

Have you read a contributing guide?

• I have read CONTRIBUTING.md
• I have searched the existing requests and didn't find any that were similar
• I have considered creating a pull request instead and want to proceed

Clear and concise description of the problem

Currently, the containers run as root, meaning that all files and folders created belong to root, resulting in troubles when trying to back up the storage folder (as well as eventual security concerns linked to running containers as root in general).

Suggested solution

It would be nice to add in the doc instructions on how to run anytype without root privileges, like using UID/GID=1000/1000. And it might be even better to be the default if possible (I'm not sure if you need root for some features?)

Alternative

Currently, to back up the storage directory, you need either to run your backup utility as root, or chown the whole directory to your user. Both solutions are not ideal.

Additional context

No response

[fb929]

I've added the documentation - https://github.com/anyproto/any-sync-dockercompose/wiki/Configuration#running-as-a-non-privileged-user-only-for-linux
please give it a try

[leleogere]

I thought it would be more complex that simply adding the UID/GID in the compose files and updating the permissions, but apparently not!
It seems to work perfectly so far, thank you! :)

Just to be sure, the .env file and etc directories still belong to root. Should I chown those too?

[fb929]

yes, you can also run chown for them.
but it's not strictly necessary, because in reality, the only folder you need to backup is the storage folder.

[leleogere]

After a few weeks, it seems to work as expected. However, when inspecting the logs, I observe a lot of:

create-bucket-1                   | mc: <ERROR> Unable to save new mc config. mkdir /.mc: permission denied.
create-bucket-1                   | ...waiting...
create-bucket-1                   | mc: <ERROR> Unable to save new mc config. mkdir /.mc: permission denied.
create-bucket-1                   | ...waiting...

Similar errors have been observed directly with the Minio Client repo: minio/mc#2640. However, I haven't checked if that was happening before the UID change in my installation or not, but I thought that it would be safer to report it. The last comment of the linked issue suggests running the Minio container as root, it seems to be related to that.

Should I ignore those errors, or will they cause some issues in the future?

[fb929]

most likely, it's the mc console client generating this error.
if the bucket is still being created, then the error can be ignored

[leleogere]

Finally, it does not seem to be working as expected. I was testing the sync between my phone and computer using my phone's hotspot, which obviously resulted in peer-to-peer sync (which works as expected), and not using the server node on the server.

After some more extensive tests (without peer-to-peer short-circuiting), it seems that text blocks are synced as expected with the server. However, images (and other files I guess) do not sync, and stay in the sync queue (spinning icon next to them in the desktop app, and stuck at "Synchronizing x elements"¹ in the android app (not sure if I can access the list of elements on android, but that x is not going down).

I'm not familiar with AnyType structure, but my guess is that text blocks and files are managed differently. Text does not seem to be affected by the UID/GID change, but files seem broken. I suppose files are managed with Minio? Could the error I spot be the cause of the sync issue with files?

¹ Or something similar, I'm using the app in French.

[leleogere]

I've run some more tests in a clean environment (to make sure there weren't something funky in my config), and I confirm that files do not sync when running rootless. Here is what I did to test:

1. Clone the repo to start from a clean config.
2. Create the storage directories: mkdir -p storage/anyStorage/any-sync-node-{1..3} storage/any-sync-node-{1..3} storage/{minio,mongo-1,redis} storage/networkStore/{any-sync-consensusnode,any-sync-coordinator,any-sync-filenode,any-sync-node-1,any-sync-node-2,any-sync-node-3}
3. Add the correct UID/GID to compose files following the command provided
4. Start the stack: make start
5. Set up the app with the newly created config.yml, and a freshly created folder to store the data (to avoid conflict with eventual previous installations)
6. Create a new user (which gets me the default space)
7. Create a new page, and add an image in it.
8. In the sync status menu (when you click on the green indicator in the sidebar), observe that the new image sync indicator keeps spinning (while the created page has been synced correctly, as it has the green checkmark).

When exploring the logs, I see regular mc: <ERROR> Unable to save new mc config. mkdir /.mc: permission denied. as I already reported.

To make sure that the issue was with the permission change, I ran the exact same test, simply omitting the steps 2 and 3 (i.e. the normal procedure, with root containers), and the image synced almost instantly as expected (and no trace of mc permission issues in the logs).

[leleogere]

As the mc and minio containers now run rootless, they can't write in /, hence the /.mc directory can't be created. I've run some tests with the variable MC_CONFIG_DIR, and it seems that setting it to a writeable place in the minio and create-bucket containers fixes the issue:

# In the docker-compose.override.yml file
# ...
  minio:
    <<: *defaults
    environment:
      MC_CONFIG_DIR: "/tmp/.mc"
  create-bucket:
    <<: *defaults
    environment:
      MC_CONFIG_DIR: "/tmp/.mc"
# ...

While this seems to work, I've tested a lot of different things, so I'll test a bit more and report back here.

EDIT: While I managed to make it work on a clean instance, I have not been able to update my existing instance so far. If I can't get it right, I'll try exporting and reimporting the spaces into a clean instance.

[bokchoi2020]

hi @fb929 and @leleogere, thanks for the steps to setup rootless containers, it was helpful. I am able to sync my notes between my phone and pc in real time. However, when I try to click on share the space, I get an error. Does that happen on your side as well?

Error:
store invite in ipfs: add data to IPFS: NoCredentialProviders: no valid providers in chain. Deprecated. For verbose messaging see aws.Config.CredentialsChainVerboseErrors, generate invite

More details
https://github.com/orgs/anyproto/discussions/341

[leleogere]

Hello @bokchoi2020,
Everything seems to work on my end, I am able to share a space without any issue, not sure what is going on with your setup.