Skip to content

Run exaslct without root in the container #32

@tomuben

Description

@tomuben

Avoid running build of script languages container as root.
The container needs to run temporarily as root in order to create user and groups.
After that, root access is not needed and may cause problems.
A potential way could, be to first create group with the same gid as is set for the docker socket and then create a user with the same uid as the caller and add it to the created group. After that, we drop the root user with su to the created user and call exaslct. This way the user can access the docker socket, but isn't root and writes files with the same uid as the caller. We might need to add the user to an additional group basically all active groups of the caller, such that he can access files or directories of the respective groups. Note: We can't change the owner or group of the docker socket, because we would change it on the host as well.

Metadata

Metadata

Assignees

No one assigned

    Labels

    featureProduct feature

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions