allow running as arbitrary uid

[willholley]

Overview

Enables the CouchDB container to run as a non-root / user-specified uid. For now, I've only modified the 2.3.1 container but if the approach is accepted we can easily backport it.

Specifically, this:

• Adds guards around entrypoints commands that require root (as suggested in Make UID & GID configurable #147)
• Broadens permissions within the container filesystem to allow access by non-couchdb users.
• Adds an example to the documentation which specifies --user.

Testing recommendations

Build the container locally:

docker build -t couchdb:2.3.1 2.3.1

Run the container as a custom user

docker run --user <user> --name mycouch -p 5984:5984 -d couchdb:2.3.1

or, run the container as a custom user with a mounted data volume:

mkdir /Users/<user>/temp/couchdb-data
docker run --user <user> --name mycouch -v /Users/<user>/temp/couchdb-data:/opt/couchdb/data -p 5984:5984 -d couchdb:2.3.1

Verify Couch is working:

curl localhost:5984

GitHub issue number

Fixes #147

Related Pull Requests

Checklist

• Code is written and works correctly;
• Changes are covered by tests;
• Documentation reflects the changes;

[wohali]

Hey @willholley , will review this later today. Looks like dev is failing for other reasons, making Travis fail. Do you have time to lend a hand?

[wohali]

@kocolosk you've been doing the reviews in this space, care to have a look?

[kocolosk]

Will do

[kocolosk]

I think the changes in the docker-entrypoint make sense -- we're basically putting the onus on the user to have all permissions configured correctly if they want to run under a custom UID.

I do worry that skipping the chown in the Dockerfile will have an impact on startup times per #131. Is there a problem with keeping that line in there?

[willholley]

Hey @willholley , will review this later today. Looks like dev is failing for other reasons, making Travis fail. Do you have time to lend a hand?

hopefully this is fixed in #152

[wohali]

@willholley I'd like to merge this but @kocolosk 's comment is still unaddressed. We need to not reintroduce a regression here. Can you help? Thanks.

[willholley]

@wohali I added back the chmod line in the Dockerfile which I think addresses @kocolosk's comments. I've also normalised the whitespace to use 4 spaces everywhere.

[wohali]

@willholley merge at your convenience!

I'll need to update the official docs upstream with your change, too, once this lands.

[tianon]

I would recommend moving this whole block up into the RUN line that creates /opt/couchdb in the first place while you're at it/here (there are some edge cases around chmod/chown in a separate layer on some graph drivers).

[willholley]

thanks @tianon - I've pushed another commit which does this. @wohali @kocolosk probably best to have another quick review before merging.

[wohali]

see his latest comment, looks like another change is req'd

[willholley]

ok - suggested change has been pushed

[kocolosk]

LGTM