Remove MONAI user ownership on MAP folders

[KavinKrishnan]

Removing fixed monai user/privilege's on application package image

[slbryson]

Agreed on the approach.

[gigony]

@KavinKrishnan
Could you please sign this commit and update the description of this PR saying the context of this PR?

I wonder to what extent does this PR solves the issue described in #202?

Do we just want to run the container as root with this PR?

[KavinKrishnan]

@KavinKrishnan Could you please sign this commit and update the description of this PR saying the context of this PR?

I wonder to what extent does this PR solves the issue described in #202?

Do we just want to run the container as root with this PR?

Yes, and think it is ok. It seems to be a bigger issue having the packager fix permissions in the image around one user monai.

In a future MR, we could provide a way for the user to decide the user when packaging the image. However in the meantime, allowing them to run the container this way should suffice.

I think the alternative you suggested with gosu and making each user a super user may not be the best practice.

[MMelQin]

Generally for application security, especially FS access controls, use a group to grant permissions to the resources, and on deployment and at runtime, a specific service account just needs to be in this defined group. The application package does not need to pin down the specific user, which is a deployment/runtime concern.

Application understands the required permission or ACL of the application specific resources (Docker image files etc, and the mapped folder on host), what specific group, and service account, to use is more the deployment platform configuration concern, to ensure the service account has the required permissions to the resources, without being granted elevated privilege.

[whoisj]

LGTM

[gigony]

Looks good to me.

With this patch, when running locally, output file would have a root permission that user needs to remove with sudo method.
Let's merge this and follow up on this issue later.

[MMelQin]

Merge this PR for now, with the understanding of having #202 to address the account and permission issue.