Installed a new debian server, installed docker, but then now i have a problem with permissions on passed directories.
On the previous server, the uid/gids inside the docker container match the uid/gid on the real server.
Root is 0, www-data is 33, and so on.
On this new server, instead, files owned by root (0) in the container are translated to 1000 on the server, www-data (33) is 100032, and so on (+1000 appended to the uid)
Is this normal or did I misconfigure something? On the previous server I was running everything as root (the interactive user was root), and i would like to avoid that
It’s actually a suggested configuration / best practice to NOT have container user IDs matching the host user IDs.
Ditch the idea of root and user in a docker container. For your containerized application use 10000:10001. You’ll have only one application and one “user” in the container anyways when doing it right.
To be even more on the secure side use a different random user ID and group ID for every container.
My go-to for user and group IDs is 1234:1234
This is really dependent on whether or not you want to interact with mounted volumes. In a production setting, containers are ephemeral and should essentially never be touched. Data is abstracted into stores like a database or object storage. If you’re interacting with mounted volumes, it’s usually through a different layer of abstraction like Kibana reading Elastic indices. In a self-hosted setting, you might be sidestepping dependency hell on a local system by containerizing. Data is often tightly coupled to the local filesystem. It is much easier to match the container user to the desired local user to avoid constant
sudocalls.I had to check the community before responding. Since we’re talking self-hosted, your advice is largely overkill.
Do I need to actually create the user in advance or can I just choose a string as I see fit?