Using a non-root user leads to some permission errors

[ArmoredGoat]

I would like to run Ocular inside a non-root container (e.g., with user: 1000:1000). The application files and all other data inside the container are owned by root.

~ $ ls -la
total 76
drwxr-xr-x    1 root     root          4096 Feb  7 11:15 .
drwxr-xr-x    1 root     root          4096 Feb  7 11:15 ..
-rwxr-xr-x    1 root     root             0 Feb  7 11:15 .dockerenv
drwxr-xr-x    2 root     root          4096 Dec 17 07:03 bin
drwxr-xr-x    3 root     root          4096 Jan 16 21:47 config
drwxr-xr-x    1 root     root          4096 Feb  7 11:15 data
drwxr-xr-x    5 root     root           340 Feb  7 11:15 dev
-rwxr-xr-x    1 root     root           521 Jan 25 17:11 entrypoint.sh
drwxr-xr-x    1 root     root          4096 Feb  7 11:15 etc
drwxr-xr-x    2 root     root          4096 Dec 17 07:03 home
drwxr-xr-x    1 root     root          4096 Dec 17 07:03 lib
drwxr-xr-x    5 root     root          4096 Dec 17 07:03 media
drwxr-xr-x    2 root     root          4096 Dec 17 07:03 mnt
drwxr-xr-x    2 root     root          4096 Dec 17 07:03 opt
dr-xr-xr-x  344 root     root             0 Feb  7 11:15 proc
drwx------    2 root     root          4096 Dec 17 07:03 root
drwxr-xr-x    3 root     root          4096 Dec 17 07:03 run
drwxr-xr-x    2 root     root          4096 Dec 17 07:03 sbin
drwxr-xr-x    2 root     root          4096 Dec 17 07:03 srv
dr-xr-xr-x   13 root     root             0 Jan  2 22:28 sys
drwxrwxrwt    2 root     root          4096 Dec 17 07:03 tmp
drwxr-xr-x    1 root     root          4096 Dec 17 07:03 usr
drwxr-xr-x    1 root     root          4096 Dec 17 07:03 var
~ $ ls -la data/
total 21
drwxr-xr-x    1 root     root          4096 Feb  7 11:15 .
drwxr-xr-x    1 root     root          4096 Feb  7 11:15 ..
drwxr-xr-x    2 root     root          4096 Jan 16 21:47 caddy
drwxrwx---    2 1000     1000            11 Feb  7 11:15 genesis
~ $ id
uid=1000 gid=1000 groups=1000

However, when run as 1000:1000 I get the following errors:

[...]

WRN ts=1770462916.9929044 logger=tls msg=unable to get instance ID; storage clean stamps will be incomplete error=open /data/caddy/instance.uuid: permission denied

ERR ts=1770462916.9929879 logger=tls msg=could not clean default/global storage error=unable to acquire storage_clean lock: creating lock file: open /data/caddy/locks/storage_clean.lock: no such file or directory

[...]

ERR ts=1770462916.993612 msg=unable to autosave config file=/config/caddy/autosave.json error=open /config/caddy/autosave.json: permission denied

INF ts=1770462916.993621 msg=serving initial configuration

Ocular is nevertheless functional, but is there any drawback to using a non-root user?

Kind regards :)

[simonwep]

Hey! I've never tried this before, so I can't say much about potential issues. But all errors seem to originate from caddy, which is the reverse-proxy responsible for either serving the frontend or handling requests to the API. If everything still works and there aren't any issues (look out for genesis which is the backend, also responsible for actually storing your data) you should be good to go :)

Nevertheless, when I have some spare time I'll have a look for how to run caddy without root permissions, although it seems to work for now.