Migrating docker apps from root to non-root user reddit / selfhosted ---------------------------------------------------------------------- inthesum · 2023-12-02 06:52 I did the mistake to create all docker container as root and now i wanted to migrate from root user to non-root user. Is there a quick and easy way to do this ? ---------------------------------------------------------------------- Datajoke · 2023-12-02 07:13 Ive done this a couple of times I think. Stop the container Modify the PUID and PGID on the docker compose file. Change the owner of the mapped volumes recursively with chown and adjust permissions with chmod if needed restart the container. ---------------------------------------------------------------------- Sudden_Cheetah7530 · 2023-12-02 07:23 Are you worrying about zero-day attack? If you are not, IMO there is no point to run containers as non-root these days. ---------------------------------------------------------------------- SillyLilBear · 2023-12-02 07:47 This only works if the container supports it, which is typically linuxserver images. ---------------------------------------------------------------------- josemcornynetoperek · 2023-12-02 08:07 Just add user to docker group, copy projekt files and change owner. ---------------------------------------------------------------------- blackstar2043 · 2023-12-02 09:38 There's that, but also running the Docker daemon as a non-root user: https://docs.docker.com/engine/security/rootless/ ---------------------------------------------------------------------- Verum14 · 2023-12-02 10:39 This is not the correct answer. This does not make docker run as non-root. As a matter of fact, it can make you less secure as if your local account is compromised, it has another possible mode of escalation to root. The docker group only allows you to run docker without sudo — docker itself still runs as root. Similar to running things with the SUID bit set. ---------------------------------------------------------------------- Vae-victus · 2023-12-02 11:12 In our enterprise we use podman, runs containers as non root even if the container itself is not rootless ---------------------------------------------------------------------- inthesum · 2023-12-02 12:05 >podman Thanks im not well versed with podman read some article and its indeed much more flexible. How come is it not as popular as docker. Does it supports docker compose files as well ? ---------------------------------------------------------------------- Vae-victus · 2023-12-02 12:06 I have no idea why it’s not the de facto tool, it’s superior. Yes you can use docker compose too ---------------------------------------------------------------------- ElevenNotes · 2023-12-02 12:46 Because it requires a little bit of effort and no one here wants that, so they all stick with root docker and root containers because they don't have to deal with file permissions or science forbid, containers accessing system sources. They all just copy/paste compose yaml and are happy. Give podman a try or at least make your docker rootless. ---------------------------------------------------------------------- Fungled · 2023-12-02 12:53 I assume you’ve installed docker rootless? I did this a while ago and it was a little painful. The problem is containers that run internally as a _non_ root user (for security reasons usually). When you run containers rootless as a local user you’ll usually want the container process running internally as user 0, which is then externally the user running the container. But some services (eg apache) will not easily let you do that But once done it’s so much superior it’s not even funny ---------------------------------------------------------------------- Psychological_Try559 · 2023-12-02 14:38 Docker really doesn't support docker compose. I suspect the reason that docker became more popular is that it's more powerful in a few senses. Docker compose + docker networking, both things podman is much more limited on, and of course docker swarm. Podman is designed with the idea that you're using something like Kubernetes or OpenShift to handle "everything else" beyond basic container control. Unfortunately, those are (correctly) seen as a lot by selfhosters! So until that changes and we get something that can fill in the gaps as easily as docker swarm + compose + networking, I don't see podman taking over. ---------------------------------------------------------------------- ScratchinCommander · 2023-12-02 14:40 Going to check out podman - the Docker network overlay is an absolute disaster, hoping podman is better in this regard. ---------------------------------------------------------------------- inthesum · 2023-12-02 14:43 Thanks for usual self hosted docker makes more sense ---------------------------------------------------------------------- teddybrr · 2023-12-02 15:31 Because things don't work out of the box when you come from docker and 95% of the docker apps don't provide podman setup or support. The same reason can be said about SELinux not being enabled everywhere. ---------------------------------------------------------------------- ElevenNotes · 2023-12-02 15:56 No. If you need proper networking in containers you need VXLAN, anything else sucks, and even then it's not that simple to isolate tenants from eachother. ---------------------------------------------------------------------- DrH0rrible · 2023-12-02 16:20 Does podman support some kind of orchestration? ---------------------------------------------------------------------- ZaxLofful · 2023-12-02 22:33 Podman has podman-compose now and has all the features that I would have if I installed Docker. It is also command line syntax compatible with normal Docker, so you can still use actual docker commands. It’s 99% feature complete (only problems are edge case networking), but it has a learning curve… I just recently converted my entire Ubuntu Docker-Compose setup to RHEL9 rootless Podman. I use this Podman Puppet module: https://forge.puppet.com/modules/southalc/podman/readme ---------------------------------------------------------------------- ZaxLofful · 2023-12-02 22:37 I just recently converted my entire Ubuntu Docker-Compose setup to RHEL9 rootless Podman. It’s 99% feature complete (only problems are edge case networking), but it has a learning curve… Podman has podman-compose now and has all the features that I would have if I installed Docker. It is also command line syntax compatible with normal Docker, so you can still use actual docker commands. I use this Podman Puppet module: https://forge.puppet.com/modules/southalc/podman/readme All of that being said, I am also a DevOps engineer by trade; so my full home stack is built on Infrastructure as Code….It’s not for beginners. I learned all of this by doing virtually the same thing with Docker, and apparently Docker has rootless mode somehow now! ---------------------------------------------------------------------- Psychological_Try559 · 2023-12-02 23:16 Interesting, yet another rabbit hole! Much appreciated ---------------------------------------------------------------------- Bright_Mobile_7400 · 2023-12-03 00:00 There’s also simply docker rootless. https://docs.docker.com/engine/security/rootless/ For most container I did it and it worked easily ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-03 00:47 Whatever route you choose, make sure it has nothing to do with Podman if you value your time and/or sanity. ---------------------------------------------------------------------- Vae-victus · 2023-12-03 11:28 yes, podman-compose, docker-compose and it can play kubernetes manifest files ---------------------------------------------------------------------- stappersg · 2023-12-03 13:27 Understanding the "problem" is always the trick. An the greatest skill is understanding the tools that you are working with. ---------------------------------------------------------------------- Charming-Molasses-22 · 2023-12-03 15:40 Every tool will give your tradeoffs to choose from. It's up to you to decide which ones are worth the squeeze. ---------------------------------------------------------------------- rrrmmmrrrmmm · 2023-12-04 10:03 This is the way.