Run as non-root user in Docker?

[inisfail]

Question description

Would it be possible to configure Sourcegraph to run as a non-root user in the Docker container?

Is your question related to a problem? If so, please describe or link to another issue.

Additional context

Thank you.

[sqs]

@ggilmore can answer this one. (Do we still need the Docker container to run as root now that it never needs to access /var/run/docker.sock anymore?)

Tentatively scheduling for 3.1 because this is something we've heard several times for Sourcegraph cluster deployments, so it seems like a good practice and important to some folks.

[inisfail]

Great, thanks for the update!

[sqs]

@ggilmore This caused pain to a user today. See https://sourcegraph.slack.com/archives/C0W2E592M/p1551148859007100.

[tsuna]

I can't see the Slack archives but that user was probably me 😅

I -v'ed Gerrit's git directory into /var/opt/sourcegraph/repos thinking that it would be enough to just mount the bare repos that Gerrit had in there to expose them to Sourcegraph, and Sourcegraph decided to do the equivalent of mkdir /var/opt/sourcegraph/repos/$foo/.git; mv /var/opt/sourcegraph/repos/$foo/* /var/opt/sourcegraph/repos/$foo/.git for every repo $foo. And this worked because Sourcegraph was running as root (otherwise it wouldn't have had the permissions to change those files, just to read them).

At first I freaked out because Sourcegraph's console was logging messages about deleting repositories, e.g.:

01:03:44          gitserver | t=2019-02-26T01:03:44+0000 lvl=eror msg="failed to delete repository" repo=foo error="stat /var/opt/sourcegraph/repos/foo/HEAD: no such file or directory"
01:03:44       repo-updater | t=2019-02-26T01:03:44+0000 lvl=eror msg="failed to remove disabled repository" worker=repo-purge repo=foo error="RepoRemove http://127.0.0.1:3178/delete: RepoRemove: http status 500: stat /var/opt/sourcegraph/repos/foo/HEAD: no such file or directory\n"

and a simple ls showed the directories were empty, so I started restoring backups, but then later I realized that Sourcegraph had just tucked things under a new nested .git directory.

None of this would've happened if Sourcegraph dropped privileges.

[sqs]

@tsuna Indeed, it was you. Sorry! @ggilmore will reply here when he has an update about when a fix for this issue will ship.

[ggilmore]

Hello @tsuna,

The Sourcegraph Docker image is built with the assumption that it has sufficient permissions to perform arbitrary file operations in the /var/opt/sourcegraph and /etc/sourcegraph volumes. Even if the container wasn’t running as root (which is what this issue is tracking), it would still require a user that has the necessary permissions for those volumes.

We will improve the documentation to communicate that the add local repo process is only intended for sideloading a large repo as a one time operation and after that, Sourcegraph owns that location on disk and can do whatever it wants. I have created a separate issue to track this work here: https://github.com/sourcegraph/sourcegraph/issues/2479