37

Is there a way to execute or login as current user to a bash of specific container . I tried running docker-compose exec -u $USER phoenix bash but it says unable to find user raz: no matching entries in passwd file

I tried another way by adding a useradd command in a dockerfile.

FROM elixir:latest

ARG USER_ID
ARG GROUP_ID

RUN addgroup --gid $GROUP_ID raz
RUN adduser --disabled-password --gecos '' --uid $USER_ID --gid $GROUP_ID raz
USER raz

RUN apt-get update && \
    apt-get install -y postgresql-client && \
    apt-get install -y inotify-tools && \
    apt-get install -y nodejs && \
    curl -L https://npmjs.org/install.sh | sh && \
    mix local.hex --force && \
    mix archive.install hex phx_new 1.5.3 --force && \
    mix local.rebar --force

COPY . /app
WORKDIR /app

COPY ./entrypoint.sh /entrypoint.sh
RUN ["chmod", "+x", "/entrypoint.sh"]
ENTRYPOINT ["/entrypoint.sh"]

but when I run docker-compose build I get a permission denied error when running the apt-get commands. I also look for gosu as a step down root user but it seems complicated.

Is it possible for added user in Dockerfile command to have same permission as my current user? I'm running WSL2 btw.

2
  • Each container has its own separate user ID space, so your user on the host may not exist inside the container. Conversely, a container only runs a single process, so it isn't usually a multi-user environment. Why does it matter what the user ID is? How would you do this task with a similar non-containerized setup?
    – David Maze
    Commented Nov 16, 2020 at 11:47
  • I'm new to docker and I follow a guide where he first generate a new project locally and then after dockerized it. He access bash on the dockerize project then generate framework specific commands that would generate files. The problem is, since the current owner of those generated files are root, when modifying or saving changes to those files in a code editor results to permission denied. I can easily resolved my issue by just chown command but would be tedious. Commented Nov 16, 2020 at 12:21

2 Answers 2

41

Building on top of the answer by Joepreludian, focusing on docker-compose:

You can use the user: and volumes: options in the compose file. For example:

  my-service:
    image: ubuntu:latest
    user: ${MY_UID}:${MY_GID}
    volumes:
      - /etc/passwd:/etc/passwd:ro
      - /etc/group:/etc/group:ro

and define these variables where you are starting your compose:

MY_UID="$(id -u)" MY_GID="$(id -g)" docker-compose up
3
  • is it possible to define 'volume' as a common block that can be re-used by different services in my compose yaml?
    – mike01010
    Commented Mar 25, 2023 at 2:45
  • 1
    I am not aware of any way to define variables inside the YAML file, but I guess you could define it as an environment variable, similarly to MY_UID and MY_GID.
    – MakisH
    Commented Mar 26, 2023 at 8:14
  • 2
    yeah, that is what im doing now and using an .env file to store them..but they are hardcoded. would prefer it to read the uid and gid from whoever is building or running the container.
    – mike01010
    Commented Mar 26, 2023 at 16:08
35

This question is pretty interesting. Let me begin with a short explanation:

Understanding the problem

In fact the user that exists inside container will be valid only inside the container itself. What you're trying to do is to use a user that exists outside a container, i.e. your docker host, inside a container. Unfortunately this movement can't be done in a normal way.

For instance, let me try to change to my user in order to get this container:

$ docker run -it --rm --user jon ubuntu whoami
docker: Error response from daemon: unable to find user jon: no matching entries in passwd file.

I tried to run a classic ubuntu container inside my docker host; Although the user exists on my local machine, the Docker image says that didn't find the user.

$ id -a
uid=1000(jon) gid=1001(jon) groups=1001(jon),3(sys),90(network),98(power),108(vboxusers),962(docker),991(lp),998(wheel),1000(autologin)

The command above was executed on my computer, proving that "jon" username exists.

Making my username available inside a container: a docker trick

I suppose that you didn't create a user inside your container. For demonstration I'm going to use the ubuntu docker image.

The trick is to mount both files responsible for handling your user and group definition inside the container, enabling the container to see you inside of it.

$ docker run -it --rm --volume /etc/passwd:/etc/passwd:ro --volume /etc/group:/etc/group:ro --user $(id -u) ubuntu whoami
jon

For a more complete example:

$ docker run -it --rm --volume /etc/passwd:/etc/passwd:ro --volume /etc/group:/etc/group:ro --user $(id -u):$(id -g) ubuntu "id"
uid=1000(jon) gid=1001(jon) groups=1001(jon)
  • Notice that I used two volumes pointing to two files? /etc/password and /etc/group? Both I mounted read only (appending ":ro") just for safety.

  • Also notice that I used the id -u, which brings me the user id (1000 on my case), forcing the user id for being the same of mine defined on my /etc/password file.

Caveat

If you try to set the username to jon rather than the UID, you're going to run into an issue:

$ docker run -it --rm --volume /etc/passwd:/etc/passwd:ro --volume /etc/group:/etc/group:ro --user jon ubuntu whoami
docker: Error response from daemon: unable to find user jon: no matching entries in passwd file.

This happens because the docker engine would try to change the username before mouting the volumes and this should exists before running the container. If you provide a numeric representation of the user, this one doesn't needs to exist within the container, causing the trick to work;

https://docs.docker.com/engine/reference/run/#user

I hope being helpful. Be safe!

4
  • 5
    The question was about Docker Compose specifically. Can you please expand your answer? Commented Aug 25, 2022 at 8:35
  • Mounting the host's passwd/group is a nice trick (+1), but it has the drawback that it involves declaring a bunch of non-existent users and groups within the container, as well as a home directory path that (probably) doesn't even exist within the container: cd ~bash: cd: /home/will: No such file or directory. So what I do is, I generate /tmp/docker_passwd and /tmp/docker_group immediately prior to docker run and mount those instead.
    – Will
    Commented Jun 13, 2023 at 8:03
  • 4
    The chained command in its unholy glory: echo "$(whoami):x:$(id -u):$(id -g)::/workspace:/bin/bash" > /tmp/docker_passwd && echo "$(whoami):x:$(id -g):" > /tmp/docker_group && docker run --user $(id -u):$(id -g) -v /tmp/docker_passwd:/etc/passwd -v /tmp/docker_group:/etc/group <other docker run flags>. This example assumes that /workspace exists within the container and can be used as my "home", for the sake of putting .bashrc and .inputrc and the like there.
    – Will
    Commented Jun 13, 2023 at 8:08
  • 5
    Holy cow. Is this the "best" practice for host/container user management..
    – MrR
    Commented Oct 31, 2023 at 1:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.