Skip to content

Create a dedicated app user and group in multistage.Dockerfile - #32

Closed
toshikish wants to merge 1 commit into
astral-sh:mainfrom
toshikish:add-app-user
Closed

toshikish wants to merge 1 commit into
astral-sh:mainfrom
toshikish:add-app-user

Conversation

@toshikish

Copy link
Copy Markdown

Fixes #29.

This pull request aims to add app user and group before copying files in multistage.Dockerfile.

@konstin

konstin commented Nov 26, 2024

Copy link
Copy Markdown
Member

I agree that we should be consistent with the user and group setting, though with this change, i'm getting an error: PermissionError: Permission denied (os error 13) about ["/etc/ssl/private"]

@toshikish

Copy link
Copy Markdown
Author

@konstin Thank you for reviewing.
The error message didn't arise in my environments (Lima on macOS, Docker rootless mode on Linux, and Kaniko on Linux).
What environment did you build Dockerfile on?

@toshikish toshikish changed the title Creates a dedicated app user and group in multistage.Dockerfile Create a dedicated app user and group in multistage.Dockerfile Nov 29, 2024
@konstin

konstin commented Nov 29, 2024

Copy link
Copy Markdown
Member

A normal docker installation (with root) on Ubuntu 24.04:

$ docker --version
Docker version 24.0.7, build 24.0.7-0ubuntu4.1
docker build -f multistage.Dockerfile . -t uv-multistage
docker run --rm -it --publish 8000:8000 uv-multistage

@toshikish

Copy link
Copy Markdown
Author

I haven't tried container build on the same environment yet, but CI build job on ubuntu-latest succeeded.
https://github.com/toshikish/uv-docker-example/actions/runs/12113065492/job/33767462978#step:5:210

@konstin

konstin commented Dec 9, 2024

Copy link
Copy Markdown
Member

The build succeeds, it produces this error at runtime: It tries to read the SSL certificates, but they are owned by root so it can't access them.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

User and group app:app does not exist in multistage.Dockerfile

2 participants