@kelson42, this requires a strategy and coordination with the zimfarm to work because we share common resources across various containers.
In a zimfarm worker, we have, a root-folder, let's say /data on the host.

Manager needs
- rw access to this to ensure it's writable so we fail early if not.
- ro to calculate available disk space
Task Worker needs:
- rw access to create its per-task workdir
- rw access to remove it on cleanup
- rw access to find and then remove ZIM files
- ro to calculate available disk space
Scraper needs rw access to store temp data and ZIM files.

In order for this to work we can either:

use root everywhere and not care about permission (current behavior)
use non-root, set 777 permission on root dir and require all future files and folder to stick to everybody permissions. Seems unrealistic and fragile.
Use non-root on a coordinated uid.

This last option would mean hard-coding an arbitrary yet identical uid for the user to run inside all of the scrapers's dockerfile/entrypoint. We'd need each to be good citizen in not accidentally doing stuff as root (if using gosu).
There would be implications on the standalone (non-zimfarm) use of the scrapers' images as this arbitrary user might not have correct permissions on destination.

Note: we're using mounts on the host but using docker volumes would have the same constraints.

Docker user should not be root #995

Description

kelson42openedon Oct 1, 2019

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

kelson42
openedon Oct 1, 2019