Dockerfile user change crashes container

[DeanAyalon]

Discussed in https://github.com/orgs/verdaccio/discussions/4629

My Environment

• verdaccio version: 5.30.3
• node version [20.11.1]:
• package manager: [npm@10.5.2]
• os: [macOS Ventura 13.6.6]
• platform: [docker]

The Bug:

FROM verdaccio/verdaccio
EXPOSE 4873

# Get curl
USER root
RUN apk update && apk add curl

# Copy scripts into container
COPY --chown=$VERDACCIO_USER_UID:root files/scripts/* /verdaccio/scripts/
RUN chmod u+x /verdaccio/scripts/*

# Switch user - CRASHES THE CONTAINER!
# USER $VERDACCIO_USER_UID
# USER verdaccio
# Enabling either of these lines will crash the container on startup
## Exit code 2, no errors, no logs

HEALTHCHECK --interval=10s --timeout=3s \
    CMD /verdaccio/scripts/healthcheck.sh

Currently, my Verdaccio server is running fine, but I do have the warning message:

(node:8) Warning: Verdaccio doesn't need superuser privileges. don't run it under root
(Use node --trace-warnings ... to show where the warning was created)

If I try to switch to the verdaccio user, as documented here - The container crashes upon startup, exiting with status code 2, no logs and no error message.

Am I doing something wrong?
Thank you

[DeanAyalon]

Update

Found the error message:
cannot open config file /verdaccio/conf/config.yaml: false

Should the file be mounted within /home/verdaccio so the verdaccio user would have permission for it?

• I have tried changing the mounted file permissions.
• I have tried chown/chmod on the directory during image build

[mbtools]

The easiest way is to do ADD your_local_config.yaml /verdaccio/conf/config.yaml to your Dockerfile.

See also the examples in https://github.com/verdaccio/verdaccio/blob/master/docker-examples/README.md

[mbtools]

Just curious... What's in your /verdaccio/scripts/healthcheck.sh?

[DeanAyalon]

Honestly, setting up the Verdaccio repository was part of my process learning Docker, the healthcheck was ultimately unnecessary, and should have been defined in the compose file anyway

But in case you are interested, here's a rundown of the process I went through with the healthcheck:

At first, when using without a proxy, I had the peculiar caching issue, in which the first request accessing the web app would "lock" the url for the script source.
This became a problem after the container was up for around an hour, and afterwards as the cache would expire, the <source url= could change to any other address directing to my computer, breaking the site and only showing a white page.

The healthcheck was implemented initially to request the website in the correct URL and analyze the HTML response - To make sure it returns the right address.
I was baffled at first that I no longer experienced that problem, the healthcheck was fixing the health issue. Later I learned the reason was it keeping the cache going on the server

After setting up the proxy, the healthcheck no longer needed to analyze the source code, but I left it for a while, simply checking if it's reachable from the web.

Since my script used curl and the Verdaccio image does not have it by default, I created a dockerfile for it. Installing curl required switching to root, but then switching back prevented the verdaccio user from accessing the configuration, which was mounted for the sake of not rebuilding.
The curious thing is that if I don't switch to root and back, the verdaccio user IS able to access the config!

[mbtools]

Thanks for sharing. I'm relatively new to docker and containers as well. There's a learning curve for sure 😄