Docker image with non-root user

Using FoundationDB
1

Team,
I would like to start the foundationdb service as a non-root user due to security reasons. I tried creating a new user in the available foundationdb docker image (version foundationdb-6.2.20), adding new user and group in the Dockerfile. But while starting the new image i am getting below error.

ERROR: error creating or opening process id file `/var/fdb/data/processId'.
Fatal Error: Disk i/o operation failed
Starting FDB server on 172.17.0.2:4500
ERROR: error creating or opening process id file `/var/fdb/data/processId'.
Fatal Error: Disk i/o operation failed

Below is the required part of docker file

WORKDIR /var/fdb

# Install FoundationDB Client Libraries

ARG FDB_ADDITIONAL_VERSIONS="5.1.7"

COPY download_multiversion_libraries.bash scripts/

RUN curl $FDB_WEBSITE/downloads/$FDB_VERSION/linux/libfdb_c_$FDB_VERSION.so -o /usr/lib/libfdb_c.so && \
	bash scripts/download_multiversion_libraries.bash $FDB_WEBSITE $FDB_ADDITIONAL_VERSIONS && \
	rm -rf /mnt/website

# Set Up Runtime Scripts and Directories

COPY fdb.bash scripts/
COPY create_server_environment.bash scripts/
COPY create_cluster_file.bash scripts/
RUN chmod u+x scripts/*.bash && \
	mkdir -p logs
VOLUME /var/fdb/data
RUN chown -R foundationdb:foundationdb /var/fdb
USER foundationdb:foundationdb
CMD /var/fdb/scripts/fdb.bash

I have added below to create the foundationdb user and group in the first part of my dockerfile.

RUN groupadd -g 1000 foundationdb
&& useradd -m -u 1000 -g foundationdb foundationdb

2

What kind of volume are you using? I’ve seen issues like this with Kubernetes hostPath volumes being owned by root even when the pod is using a different user.

3

John, I am trying to do this in my docker setup created in “ubuntu 16.04 installed virtualbox VM” on my host mac.