Set custom UID and GID in docker

[mada199122]

Is it possible to set a different UID and GID in docker compose?

If I add the command user: $(id -u):$(id -g) with a UID not belonging to a root user Podsync cannot access to the file.

Thanks

[girlpunk]

If you're changing the user an existing install runs as, you'll likely need to go through and change the permissions on all the files so that the new user has access to them. That's likely what caused the issue when changing the user in Docker directly.

[mada199122]

tried with a clean new volume...
but it doesn't work...

[paulstaab]

Setting a custom UID and GID works for me if I also mount a volume for /app/db in the container with e.g. -v podsync-database:/app/db.

[BeansIsFat]

This worked as far as keeping podsync running, but if the user doesn't have root privileges yt-dlp can no longer be updated. This is the error message:

ERROR: Unable to write to /usr/bin/yt-dlp; Try running as administrator
error="failed to execute youtube-dl: exit status 100"

[girlpunk]

That seems expected, updating any software used by a container should be done by building a new image and replacing the container

[BeansIsFat]

Why is that expected? Podsync has a self-update function for yt-dlp so it's not designed to function the way you described. Or rather, it doesn't have to function that way.

[girlpunk]

Containers should be considered ephemeral. Any container running the same image with the same environment variables, fold/port bindings, etc, should function identically. In addition, a common security recommendation (1, 2) for docker containers running in production environments is to make the container's root filesystem read-only to enforce this and reduce attack vectors.

That is to say, podsync (or any containerised software) should not modify any files outside of folders mounted into the container for the express purpose of doing this. Updating binaries and other software should be done by rebuilding the container's image to include those changes, and running a new container with the new image.

[hwangeug]

I was able to at least get the podsync process to run and create files under a custom uid by:

1. Bind mounting /app/db
2. Setting ownership of the host's mountpoint of the /app/db dir to the desired uid
3. Adding this line to my docker-compose:

sh -c 'adduser -u 1000 -D podsync && adduser podsync users; su - podsync -c "/app/podsync --no-banner -c /app/config.toml"'