Starting a container as non-root user

[michael-schnell]

It would be nice to allow starting a container with a non-root user.

On the Docker command line this is normally done with the "--user" argument:

--user 1000:1000 

The container class should allow parameter like:

.withUser("1000:1000")
.withUid(1000)
.withGid(1000)
.withCurrentUid()
.withCurrentGid()

The last two are convenience functions to simply use the current user's UID and GID (the user that is running the test).

[PandarinDev]

This would be a really useful addition as we want to be able to delete mapped files created by our test containers at the end of our tests. Unfortunately these files are currently left there with root permissions so we need to delete them manually which is a major pain. If we could configure UID and GID this problem would be solved.

[bsideup]

See https://www.testcontainers.org/features/advanced_options/#customizing-the-container. It allows customizing the low level CreateContainerCmd that is passed to Docker, including user/uid/gid.

[fmarot]

@michael-schnell did you ever manage to make it work in a simple way ?

[michael-schnell]

No, I didn't test it. We switched to starting/stopping the Docker containers with a Maven plugin in the POM before/after integration tests.

[fmarot]

just for the record, something like this achieves what we want (as long as environment variables are correctly set). It may help someone one day.

		String groupID = System.getenv("groupID");
		String userID = System.getenv("userID");

		GenericContainer dockerContainer = new GenericContainer(dataGeneratorImageName);

		dockerContainer.withCreateContainerCmdModifier(cmd -> ((CreateContainerCmd) cmd).withUser(userID + ":" + groupID));

		dockerContainer.withFileSystemBind(inputFolder, "/input", BindMode.READ_ONLY)
				.withFileSystemBind(outputFolder, "/output", BindMode.READ_WRITE)
				.withEnv("SCRIPT_PARAMS", command)
				.withPrivilegedMode(false)
				.waitingFor(new LogMessageWaitStrategy().withTimes(1).withRegEx("bla bla"));

[VenkateswaranJ]

val uid = ProcessBuilder("id", "-u").start().inputStream.bufferedReader().readText().trim()
val gid = ProcessBuilder("id", "-g").start().inputStream.bufferedReader().readText().trim()

dockerContainer.withCreateContainerCmdModifier { cmd -> cmd.withUser("$uid:$gid") }

[michael-schnell]

Getting the user "uid" and "gid" is even easier - No "ProcessBuilder" needed (Linux only):

import com.sun.security.auth.module.UnixSystem;

UnixSystem system = new UnixSystem();
String uid = system.getUid();
String gid = system.getGid();

See https://docs.oracle.com/javase/8/docs/jre/api/security/jaas/spec/com/sun/security/auth/module/UnixSystem.html

[kiview]

Thanks for sharing, it is completely valid to use dockerContainer.withCreateContainerCmdModifier for this use case.