Skip to content

Commit 77c1d2d

Browse files
committed
Tweak wording and example
1 parent 0395be1 commit 77c1d2d

1 file changed

Lines changed: 7 additions & 7 deletions

File tree

docs/misc/non-root.md

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@
77

88
If you run one of our typical images in a standard Docker setup, the container itself will run as `root`. After init we then drop to an unprivileged user, `abc` to run the actual application service(s). We do this because at the time we designed our architecture the alternative - setting a fixed unprivileged user at build time - would have prevented us from offering the range of options that wanted to. While it is now possible to use the `--user` parameter to run any container as an arbitrary user, it hasn't been something we've been able to support before now.
99

10-
The other approach is to run [Docker itself rootless](https://docs.docker.com/engine/security/rootless/). This creates a separate user and network namespace for your containers that separates them from the host and means that even containers nominally running as `root` don't have root permissions on your host. Running a container as a non-root user and running it rootless are **not** the same, but are commonly conflated.
10+
The other approach is to run [Docker itself rootless](https://docs.docker.com/engine/security/rootless/). This creates a separate user and network namespace for your containers and means that even containers nominally running as `root` don't have root permissions on your host. Running a container as a non-root user and running it rootless are **not** the same, but are commonly conflated.
1111

1212
## Why?
1313

@@ -30,7 +30,7 @@ Will run the container as that user, and that cannot then be changed without rec
3030
3131
Our images use s6 as a supervisor and that needs to be able to write its service files to `/run`; many applications expect to be able to write to their working directory, changing UIDs and GIDs requires writing to `/etc/passwd` & `/etc/group`, installing new packages requires writing to numerous locations, and mods need to be extracted to the container filesystem. In short, there are some heavy limitations around operation of our images with a non-root user:
3232

33-
* The PUID & PGID variables will not have any effect, the container will instead run applications with the UID & GID of the user you have specified
33+
* The PUID & PGID variables will not have any effect, the container will instead run applications with the UID & GID of the user you have specified via the `--user` parameter
3434
* You will need to manually manage the permissions of any mounted volumes or paths
3535
* Docker Mods will not be run
3636
* Custom Services will not be run
@@ -43,16 +43,16 @@ For example:
4343
```yaml
4444
services:
4545
sonarr:
46-
image: lscr.io/linuxserver/sonarr:latest
47-
container_name: sonarr
46+
image: lscr.io/linuxserver/radarr:latest
47+
container_name: radarr
4848
environment:
4949
- TZ=Europe/London
5050
volumes:
51-
- /path/to/sonarr/data:/config
52-
- /path/to/tvseries:/tv
51+
- /path/to/radarr/data:/config
52+
- /path/to/movies:/movies
5353
- /path/to/downloadclient-downloads:/downloads
5454
ports:
55-
- 8989:8989
55+
- 7878:7878
5656
restart: unless-stopped
5757
user: 1000:1000
5858
```

0 commit comments

Comments
 (0)