How to specify a user to run the garden container?

[ghost]

hello, i push a app use a docker image i make. but this app need to run the start command by a specicial user, not vcap. and it need to write something to the container. when i run the start command it appear "permission deny". I login to the container find that the user and user group was changed to this:
drwx------ 6 65534 65534 4096 Mar 7 09:44 myuser
-rwxr-xr-x 1 65534 65534 520 Mar 7 10:18 startServer.sh

so i have some questions:

1. how to change the authority of the directoryand when container start?
2. how to specify a user to run this container?
3. the garden container do not allow to write something to file?
4. is there a document to teach us to make a docker app image to support the diego?

thank you !

[cf-gitbot]

We have created an issue in Pivotal Tracker to manage this. You can view the current status of your issue at: https://www.pivotaltracker.com/story/show/89843986.

[onsi]

Hi @HelloLin - our goal is to eventually support Docker images without the need for any modification. The largest remaining gap is around support for users and groups -- our goal is to honor the Docker USER directive and create whatever user is specified in the Dockerfile that generated the Docker image. That should resolve all your issues simultaneously.

However, we have a number of higher priority items at this point but will try to address this as soon as we can.

For now, your best bet is to open up the permissions on your container file system to allow an arbitrary user to successfully launch the application (for example, you may need to change the permissions on the destination file that your script attempts to write to).

[ghost]

@onsi thank you for your answer. in fact, i find there is a struct define for specify the user when start the container, but default set to vcap or root. so i solve it by adding a script in "/var/vcap/packages/garden-linux/skeleton/setup.sh"

if [ -d "$rootfs_path/mydir/" ]; then
chroot $rootfs_path chown -R vcap:vcap /mydir
fi

in this way i can write to this dir, but, is this a good way to solve this question?,if mydir is big enough, it will take me a long time.

is diego will support to push a dockerfile to create a app in the feature?
the most important question is when the community will publish the release which eventually support Docker images?
thank you very much.

[onsi]

We want to implement user support comprehensively and correctly. Your script gets you past the current barrier but is not a long-term solution.

Diego currently supports pushing dockerfiles to create applications. There are issues around users (as I mentioned) but apart from that you can tell cloud controller you want a docker-based application today. The CF diego plugin (installation instructions here) has subcommands for pushing docker applications. You do need to enable diego-docker support in CC (it's turned off by default).

At this point we don't recommend running Docker applications in multi-tenant environments.

[ghost]

thank you for your answer.