Accidentally ran rootless: (Fatal SSL error crash), can rootless be supported? about grist-core HOT 5 OPEN

paging @Spoffy given upcoming #1031

from grist-core.

Hey @josh-hemphill! Am I right in thinking you're running the docker image under podman here?

Could you try running this branch spoffy/run-docker-as-non-root and seeing if it works for you?

It should handle rootless better, although there's no guarantee as I haven't tested it under podman!

from grist-core.

Ah, I figured it out, I had added the --userns=keep-id flag to my containers, so it didn't have root permissions.

from grist-core.

I've seen other projects (like gitea) distribute separate docker containers that have the changes to UID/GID set up by default so you just have to use a different tag. Is that something a PR might be accepted for?

from grist-core.

@Spoffy It seems to be running fine. I've been migrating my Compose files to kube.yaml files, and using podman kube play to create each of my apps' containers inside a pod. (the kube.yaml files were not as verbose as I thought, pretty comparable to the Compose files, hence why I'm switching)

This is how I'm running it:

apiVersion: v1
kind: Pod
metadata:
  name: podgrist
  annotations:
    io.podman.annotations.userns: keep-id
spec:
  containers:
    - args:
        - ./sandbox/run.sh
      env:
        - name: GRIST_SESSION_SECRET
          value: "some secret"
        - name: GRIST_SANDBOX_FLAVOR
          value: gvisor
        - name: APP_HOME_URL
          value: "https://example.com"
        - name: GRIST_DOCKER_USER
          value: "1000"
        - name: GRIST_DOCKER_GROUP
          value: "1000"
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
      image: localhost/grist-test
      name: grist
      ports:
        - containerPort: 8484
          hostPort: 33668
      tty: true
      volumeMounts:
        - mountPath: /persist
          name: hosting-grist-data-host-0
  hostname: "example.com"
  volumes:
    - hostPath:
        path: "./data"
        type: Directory
      name: hosting-grist-data-host-0

And running it with: podman kube play --replace --no-hosts --userns=keep-id --start=false --annotation hosting=services ./kube.yaml
Although the only reason I have to specify --userns=keep-id is because I have to use the last major version of Podman that doesn't respect annotations: io.podman.annotations.userns: keep-id, because the latest version doesn't support Ubuntu 22.04

from grist-core.