You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Avoid running build of script languages container as root.
The container needs to run temporarily as root in order to create user and groups.
After that, root access is not needed and may cause problems.
A potential way could, be to first create group with the same gid as is set for the docker socket and then create a user with the same uid as the caller and add it to the created group. After that, we drop the root user with su to the created user and call exaslct. This way the user can access the docker socket, but isn't root and writes files with the same uid as the caller. We might need to add the user to an additional group basically all active groups of the caller, such that he can access files or directories of the respective groups. Note: We can't change the owner or group of the docker socket, because we would change it on the host as well.
The text was updated successfully, but these errors were encountered:
Avoid running build of script languages container as root.
The container needs to run temporarily as root in order to create user and groups.
After that, root access is not needed and may cause problems.
A potential way could, be to first create group with the same gid as is set for the docker socket and then create a user with the same uid as the caller and add it to the created group. After that, we drop the root user with su to the created user and call exaslct. This way the user can access the docker socket, but isn't root and writes files with the same uid as the caller. We might need to add the user to an additional group basically all active groups of the caller, such that he can access files or directories of the respective groups. Note: We can't change the owner or group of the docker socket, because we would change it on the host as well.
The text was updated successfully, but these errors were encountered: