search

broadinstitute / viral-ngs-deploy

Deployment files related to https://github.com/broadinstitute/viral-ngs
Other
1 stars 3 forks source link

Handling of write permissiong to docker's /data volume #28

Open biocyberman opened 7 years ago

biocyberman commented 7 years ago

Currently I have to set world-writable for host user data directory so that docker can write to this via data volume. So I propose the following solution so that docker can have the same read/write permission as the docker running user has:

Aim: to match userid and groupid of viral-ngs-user inside docker to host's current running user.

In order to do that, viral-ngs installation location inside docker should be moved to system-wide location, for example /opt. We can then move the creation of viral-ngs-user to the ENTRYPOINT script env-wraper.sh, and so that userid and groupid can be matched during docker image startup. In doing so, su-exec tool might be needed. Do you think this is worth doing @tomkinsc ?

tomkinsc commented 7 years ago

I could see where requiring world-writability of files on the host system would be annoying, and am open to changes. If you submit a PR with what you have in mind, I look forward to seeing how this could work. Part of the incentive for distributing viral-ngs as a conda package is that we don't have to install it at a system level, which is important for those who would like to install/run the package but lack admin privileges (including on our Institute HPC systems). Installing to /opt seems like a reasonable compromise to make the package available the system at large, provided world executability. For setting the uid, have you tried chroot --userspec=$UID / as mentioned in the gosu repo? Otherwise gosu may be a good option if we can install the binary from an aptitude source rather than compiling su-exec.

I might prefer gosu over su-exec even though it is a bit larger

biocyberman commented 7 years ago

chroot --userspec=$UID does not solve the permission problem, and it requires that the same user exists in docker already.

I will go with gosu if you are OK with it. I actually found that first, but then thought it would save some space to use su-exec. Let's come back to that when su-exec is included in Ubuntu repo.

biocyberman commented 7 years ago

@tomkinsc Modification is completed. I am waiting for the #29 to finish before submitting a new PR.