‫Brandon's in with the first.
‫Next question here go sue versus user.
‫How do you prefer to go about using non root users in containers and keep file permissions on the or
‫Hossain.
‫What's the current best practice so permissions in Docker.
‫Not fair to say that Docker itself with the files you're running in a container can be very frustrating
‫especially if you're using bind mounts so bind mounts combine the permissions of the host files with
‫those things running in the container and that can often lead to you pulling your hair out and going
‫a little insane and some of my hardest projects have been when we needed multi server shared files storage
‫for can multiple containers on different host all accessing the same files with the right permissions
‫and also using least privilege with non admin users non root users right.
‫So those can be really tricky.
‫I would say user versus go.
‫So when you ask me about user Brandon I'm assuming you're talking about in the DR image building because
‫that's where users applied right.
‫And it goes to tends to work better than Sue do inside of building a dog or image.
‫So that's my understanding at least of why go Sue is often used inside of Docker images for building
‫and I don't actually know the reason why I probably learned it at some point years ago and then quickly
‫forgot it.
‫So my I'm assuming what your question is really talking about is when you're building images and I would
‫say the user is the best practice there for using Docker file lines if you're inside a run command and
‫you need to change permissions on a specific part of that run command and that's where it goes through
‫to me makes sense because you maybe need to do things as root user but not always inside that run command.
‫So maybe that's when you're choosing to go go through and other things right.
‫So I think that largely what ends up happening with people that with permissions is not the files in
‫the image it's the files during runtime right.
‫So once your container starts up let's say you've got a node app and that node app is running is user
‫node and it has a user upload directory and then those files are stored on the host and so they're gonna
‫be stored as the user node and because that's what's nodes running is running it and then you have some
‫other process maybe a different container and using a shared volume or something or a buying amount
‫and that that is not running as the same user and needs to access those files read right and you get
‫into these problems around permissions.
‫So I would say that at the end of the day if you can't solve these problems with shown in mod then it
‫doesn't.
‫In other words inside the docker file if you're doing for example a copy command instead of a doctor
‫file you can now do a shown on that so that when you're copying files and they copy with the right users
‫that are given permissions to those files you can't do a command.
‫I don't think yet although that may be a feature that's actually something and look up much of that
‫has been added.
‫The Ducker.
‫So we go to the official documentation on that right zoom in and if I go to yeah.
‫So if I search shimmered I don't see anything.
‫But if I go to shown you can see where if you use the ad or the copy you can copy those in with the
‫right permissions.
‫That's a huge thing that happened a year or two ago that saves us a lot of space because we then don't
‫have to change the permissions on the files that step one step two is if you need to change permissions
‫of directories at runtime like you need to have a volume set to certain permissions.
‫That's what an entry point script is for.
‫So if you were to look at an example like if we just go back over here to Docker Hub and I were to go
‫into my sequel and if you went to one of them my sequel Docker files you would probably find that there
‫is an entry point script especially with things like databases and an entry point script something that
‫can will start every time a container is started and often in these entry points scripts you will see
‫things like I need you to shown everything in this directory and mod it or you know do a plus right
‫global or something which is not always the most secure thing to do but if you need to change permissions
‫on the fly then you would do that inside the script.
‫Now of course the problem in this script is that it's running as the user I believe so as it's running
‫as the user that you set in a docker file so that becomes another problem because if you need to change
‫permissions on files to make them readable and readable by the node user but the script is running as
‫a node user then you have problems because you can't you can't go to route.
‫Essentially at that point.
‫So I would say that there is no easy or best fix for that but permissions is something you could probably
‫write a whole course section on write a whole multi hour training session on the various ways the permissions
‫are dealt with.
‫One little tidbit there.
‫The last thing I'll say is I know that I'm kind of going on on your question but it is something that
‫I think comes up a lot is that file permissions in Linux are just numbers.
‫In fact this is actually a tip that was given to me I think by Phil Estes who is someone who implemented
‫the the namespace the user namespace issues.
‫I'm sorry the user namespace feature inside of Docker which has not enabled by default.
‫But if you wanted to have all your containers run as non root you would enable that.
‫And he was one of the ones that helped add that feature and we were talking one day and he pointed out
‫that you know the user I.D. and the group I.D. are just ideas you can set that number to whatever you
‫want.
‫They're just numbers.
‫And so if you need files on the host for example to match those in the container if you just set everything
‫by I.D. number then user names are at that point really irrelevant.
‫They it's really the I.D. that it's going to look at for matching those permissions.
‫So in a case where I was working on a project and we needed to share files across multiple containers
‫but they were all running as different users and we needed to make sure that the permissions matched
‫up.
‫We really just manually made sure those files were using the right numbers or I.D. for the owner and
‫the group and then everything started to work because that didn't really matter that we didn't have
‫the user created on the host for example that was matching that I.D. inside the container.
‫We just made sure the I.D. numbers matched up so that's a little tip.
‫It took me a while to figure that out and to understand how those worked but really just at the end
‫of the day it's doing no comparison to make sure that the numbers of the the reads and rights and permissions
‫match what the user that's executing the command is doing.
‫Good question.
‫I'm glad that you brought that up because that's not something that we've had discussed here recently
‫and we should talk about it more.