[Bug Report]: Unifi UID/GID

[Sophist-UK]

App Name

unifi

Version (TrueNAS Catalog App Version)

1.4.17

App Issue

Most apps allow you to specify a UID and GID to run under.

Unifi has a fixed UID of unifi=999 and GID of unifi=999.

UIDs and GIDs under 1000 I believe are reserved for TrueNas O/S standard ids, and UID=999 is netdata and GID=999 is docker.

For security reasons these are NOT the UID and GID that unifi should be running under.

I would suggest that a possible solution is to add tailorable UID and GID to the unifi app definitions, both defaulting to 999, and then the user can change these defaults to an app specific UID if they so wish.

App Logs

[stavros-k]

We don't build the container, so we can't really change the UID/GID of the user.
Container is not setup to be able to run as arbitrary user.

And no setting UNIFI_UID is not gonna make container run as any user, it will instead require the whole container to run as root, so it can modify user/group. https://github.com/goofball222/unifi/blob/7d339aa60593ac9c8149aa92bcf4f0e889798133/9.5/official/root/usr/local/bin/entrypoint-functions.sh#L48-L66

[Sophist-UK]

Hmm. I am not a docker expert, but surely you shouldn't have to start a docker package as root simply to have it use a different uid/gid?

There are several people who have created Unifi docker images - aside from https://github.com/goofball222/unifi the most popular and regularly updated are:

• https://github.com/jacobalberty/unifi-docker
• https://github.com/11notes/docker-unifi

I have no idea whether these are better images than the `goofball222 one, but there is clearly a choice, and there may be others not listed above.

I believe that one of the design goals of the apps UI is to make it possible to swap out the underlying docker images with others that have a superset of functionality - but I appreciate that backwards compatibility is essential and that may not be possible with these other images.

I also understand that you won't want to maintain multiple Unifi images ongoing, but I am hoping that you might be willing to mark the current one as deprecated in order to provide better functionality in a new Unifi app that would be maintained going forwards.

[stavros-k]

https://github.com/jacobalberty/unifi-docker Works exactly the same as goofball222/unifi.
Requires root to chmod/groupmod, these ops require root.

11notes/docker-unifi, runs as 1000, this requires a container rebuild to change.

What user(s) a container is able to run, is coupled with how the container is created (and sometimes not possible based on what they actually do).

If an app is able to run as arbitrary user, we expose that.

[Sophist-UK]

I would guess that it isn't possible to move the netdata uid or the docker gid either.

I originally ran the Kubernetes Unifi and that had a unique uid/gid which I could set. But I have it working with netdata:docker so I guess we need to stick with that.

So thanks for you help.