Brandon's in with the first. 1
Next question here go sue versus user. 2
How do you prefer to go about using non root users in containers and keep file permissions on the or 3
Hossain. 4
What's the current best practice so permissions in Docker. 5
Not fair to say that Docker itself with the files you're running in a container can be very frustrating 6
especially if you're using bind mounts so bind mounts combine the permissions of the host files with 7
those things running in the container and that can often lead to you pulling your hair out and going 8
a little insane and some of my hardest projects have been when we needed multi server shared files storage 9
for can multiple containers on different host all accessing the same files with the right permissions 10
and also using least privilege with non admin users non root users right. 11
So those can be really tricky. 12
I would say user versus go. 13
So when you ask me about user Brandon I'm assuming you're talking about in the DR image building because 14
that's where users applied right. 15
And it goes to tends to work better than Sue do inside of building a dog or image. 16
So that's my understanding at least of why go Sue is often used inside of Docker images for building 17
and I don't actually know the reason why I probably learned it at some point years ago and then quickly 18
forgot it. 19
So my I'm assuming what your question is really talking about is when you're building images and I would 20
say the user is the best practice there for using Docker file lines if you're inside a run command and 21
you need to change permissions on a specific part of that run command and that's where it goes through 22
to me makes sense because you maybe need to do things as root user but not always inside that run command. 23
So maybe that's when you're choosing to go go through and other things right. 24
So I think that largely what ends up happening with people that with permissions is not the files in 25
the image it's the files during runtime right. 26
So once your container starts up let's say you've got a node app and that node app is running is user 27
node and it has a user upload directory and then those files are stored on the host and so they're gonna 28
be stored as the user node and because that's what's nodes running is running it and then you have some 29
other process maybe a different container and using a shared volume or something or a buying amount 30
and that that is not running as the same user and needs to access those files read right and you get 31
into these problems around permissions. 32
So I would say that at the end of the day if you can't solve these problems with shown in mod then it 33
doesn't. 34
In other words inside the docker file if you're doing for example a copy command instead of a doctor 35
file you can now do a shown on that so that when you're copying files and they copy with the right users 36
that are given permissions to those files you can't do a command. 37
I don't think yet although that may be a feature that's actually something and look up much of that 38
has been added. 39
The Ducker. 40
So we go to the official documentation on that right zoom in and if I go to yeah. 41
So if I search shimmered I don't see anything. 42
But if I go to shown you can see where if you use the ad or the copy you can copy those in with the 43
right permissions. 44
That's a huge thing that happened a year or two ago that saves us a lot of space because we then don't 45
have to change the permissions on the files that step one step two is if you need to change permissions 46
of directories at runtime like you need to have a volume set to certain permissions. 47
That's what an entry point script is for. 48
So if you were to look at an example like if we just go back over here to Docker Hub and I were to go 49
into my sequel and if you went to one of them my sequel Docker files you would probably find that there 50
is an entry point script especially with things like databases and an entry point script something that 51
can will start every time a container is started and often in these entry points scripts you will see 52
things like I need you to shown everything in this directory and mod it or you know do a plus right 53
global or something which is not always the most secure thing to do but if you need to change permissions 54
on the fly then you would do that inside the script. 55
Now of course the problem in this script is that it's running as the user I believe so as it's running 56
as the user that you set in a docker file so that becomes another problem because if you need to change 57
permissions on files to make them readable and readable by the node user but the script is running as 58
a node user then you have problems because you can't you can't go to route. 59
Essentially at that point. 60
So I would say that there is no easy or best fix for that but permissions is something you could probably 61
write a whole course section on write a whole multi hour training session on the various ways the permissions 62
are dealt with. 63
One little tidbit there. 64
The last thing I'll say is I know that I'm kind of going on on your question but it is something that 65
I think comes up a lot is that file permissions in Linux are just numbers. 66
In fact this is actually a tip that was given to me I think by Phil Estes who is someone who implemented 67
the the namespace the user namespace issues. 68
I'm sorry the user namespace feature inside of Docker which has not enabled by default. 69
But if you wanted to have all your containers run as non root you would enable that. 70
And he was one of the ones that helped add that feature and we were talking one day and he pointed out 71
that you know the user I.D. and the group I.D. are just ideas you can set that number to whatever you 72
want. 73
They're just numbers. 74
And so if you need files on the host for example to match those in the container if you just set everything 75
by I.D. number then user names are at that point really irrelevant. 76
They it's really the I.D. that it's going to look at for matching those permissions. 77
So in a case where I was working on a project and we needed to share files across multiple containers 78
but they were all running as different users and we needed to make sure that the permissions matched 79
up. 80
We really just manually made sure those files were using the right numbers or I.D. for the owner and 81
the group and then everything started to work because that didn't really matter that we didn't have 82
the user created on the host for example that was matching that I.D. inside the container. 83
We just made sure the I.D. numbers matched up so that's a little tip. 84
It took me a while to figure that out and to understand how those worked but really just at the end 85
of the day it's doing no comparison to make sure that the numbers of the the reads and rights and permissions 86
match what the user that's executing the command is doing. 87
Good question. 88
I'm glad that you brought that up because that's not something that we've had discussed here recently 89
and we should talk about it more.