A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.
Rules:
Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam posting.
Posts have to be centered around self-hosting. There are other communities for discussing hardware or home computing. If it's not obvious why your post topic revolves around selfhosting, please include details to make it clear.
Don't duplicate the full text of your blog or github here. Just post the link for folks to click.
Submission headline should match the article title (don’t cherry-pick information from the title to fit your agenda).
No trolling.
Resources:
Any issues on the community? Report it using the report flag.
Questions? DM the mods!
It's actually a suggested configuration / best practice to NOT have container user IDs matching the host user IDs.
Ditch the idea of root and user in a docker container. For your containerized application use 10000:10001. You'll have only one application and one "user" in the container anyways when doing it right.
To be even more on the secure side use a different random user ID and group ID for every container.
My go-to for user and group IDs is 1234:1234
This is really dependent on whether or not you want to interact with mounted volumes. In a production setting, containers are ephemeral and should essentially never be touched. Data is abstracted into stores like a database or object storage. If you’re interacting with mounted volumes, it’s usually through a different layer of abstraction like Kibana reading Elastic indices. In a self-hosted setting, you might be sidestepping dependency hell on a local system by containerizing. Data is often tightly coupled to the local filesystem. It is much easier to match the container user to the desired local user to avoid constant sudo calls.
I had to check the community before responding. Since we’re talking self-hosted, your advice is largely overkill.
Do I need to actually create the user in advance or can I just choose a string as I see fit?
checked .bash_history, looks like i installed docker in the new rootless mode
wget get.docker.com
ls
mv index.html docker.sh
chmod +x docker.sh
./docker.sh
dockerd-rootless-setuptool.sh install
sudo dockerd-rootless-setuptool.sh install
sudo apt install uidmap
dockerd-rootless-setuptool.sh install
now i need to see how to restore it to work in the traditional way or i will become crazy with the permissions...
I fixed it:
for future reference:
dockerd-rootless-setuptool.sh uninstallWhy go through all of that complexity when you could just sudo apt install docker?
i don't want to type sudo before each single docker command
You can do that with regular docker. Just add your user to the docker group.
(don't forget to log out and log in again after adding new groups to your user)
Niche use case, but you can also use newgrp to run commands with a recently-added group to your user, without having to logout/login yet.
So add your user to the new docker group made on install of that package and you'll be able to docker without sudo.
You may need to relogin or newgrp docker before it works tho
Looks like you are running rootless.
I'm not very well versed on docker, but this sounds like a config issue. The behavior seems similar to "squash root" found in many other services.