Kay Gosho

Posted on Apr 24, 2018

Specifying user and group in Docker

#docker #linux #archlinux

If we use Docker as our development environment, we would use docker command to generate files.

e.g.

docker run --rm ruby:2.4 bundle exec rails g ...
docker-compose run --rm web composer install

The problem is that the owner and group of files that these commands generate are always root.

Note: this problem may happen only with Linux's Docker. Mac doesn't. Windows unknown.

Solution 1: Dockerfile

We can set owner and group in Dockerfile.
The official document says we can do it by USER postgres, but we can also set group with :.

# Dockerfile

USER 1000:1000

However, this way specifies owner and group id.
I found more flexisible solutions.

Solution 2: command argument

docker run -u 1000:1000 debian bash

In this way, we can set user and group with shell variables like $UID.
Or getent group staff | cut -d: -f3.

Solution 3: specify in docker-compose.yml

I was looking for this.

The principle is the same as solution 2, so the following config works well:

# docker-compose.yml

web:
  image: ruby:2.4
  user: "${UID}:${GID}"

Then run

UID=${UID} GID=${GID} docker-compose up

Or, export these variables as environment variables, ignoreing bash: UID: readonly variable

export UID=${UID}
export GID=${GID}
docker-compose up

Environment

Arch Linux
Docker 1.12.3 linux/amd64

Off topic

My favorite desktop Linux is Arch Linux.

pacman, the package management system for Arch, always provides the latest version of any package.

With Docker container, any host machine is OK.

Refs

Top comments (15)

Timur Vasyunin • Apr 11 '20

Or you can also set up user/group remapping by configs of your OS (/etc/subuid, /etc/subgid). See docs.docker.com/engine/security/us... to get more information.

It can be more convenient is some cases.

Kay Gosho • May 27 '20

Thanks for the information!

Dev_NIX • Jan 10 '20 • Edited

You can also provide a default value, and override it with the environment variable or with a docker-compose.override.yml:

web:
  build: 
    context: docker/web
    args:
      uuid: ${CURRENT_UID:-1000}

And then in your Dockerfile:

RUN usermod -u $uuid www-data

Kay Gosho • Jan 10 '20

Thank you for the information!

Varun Batra • Sep 21 '18

Any way without export UID?

Kay Gosho • Sep 22 '18

env UID=${UID} GID=${GID} docker-compose up would work without export UID, I suppose!

Varun Batra • Sep 30 '18

Hi, if I do this, on restart (if I have docker always restart) permission is lost on system boot. Hence, this isn't a good way to do it.

Kay Gosho • Oct 16 '18

Hi Varun,

Oh really? I don't have such experiences, as file permission usually doesn't change on system boot.

Varun Batra • Oct 16 '18 • Edited

Let us say that you have a docker container which will keep creating files with some logic - in my case it is compressing the images.

I have written a blog for the docker I have added to a tool:

Lossless Image Compressions using Docker

Now what it does is - it reads image - move image to temp folder, compress it, copy back to its original location.

All goes well as I have started it with $UID as mentioned in your post.

However, let us say now the machine is restarted - somehow $UID becomes a root.

If you have observed the same problem? After restart - some images I uploaded are now compressed with the root user and not www-data as originally intended.