Rootless Docker: file ownership changes

[stephang]

Running Lando with rootless Docker is a bumpy ride. After working-around the issues in #3267 (see comment), Lando works. However, file ownerships change when running lando start.

I'm running Ubuntu 21.10, Docker 20.10.12, Lando 3.6.0.

Reproduce

First, make sure you have rootless Docker running (see hints for setup). Then, setup your project directory.

$ whoami
someuser
$ mkdir lando-rootless
$ cd lando-rootless 
$ echo "<?php phpinfo();" > index.php
$ ls -l
-rw-rw-r-- 1 someuser someuser ... index.php

Initialize & start Lando.

$ lando init --recipe lamp --name rootless-test --webroot '.'
$ lando start

Actual behaviour:

A lot of file ownerships changed from someone to 100999.

$ ll         
-rw-rw-r-- 1 100999 100999 ... index.php

# Many more files have changed owners in home directory.
$ find ~ -uid 100999
/home/someuser/.local/share/docker/...
...
/home/someuser/.lando/...
...
/home/someuser/.gitconfig
/home/someuser/.ssh
/home/someuser/.../lando-rootless

Expected behaviour:

No file ownership changes at all.

Explanation

Two things work together here. Rootless Docker (and Podman) use the kernel feature user namespace maps. So when inside the container we have the user www-data, outside of the container, this is 100999. Thus, when www-data inside the app container creates a file, the file's owner outside the container is 100999 (or another big number, depending on your system setup).

Additionally, when Lando is run, it seems that the function perm_sweep() is run. This causes lots of chowns on various (mounted) paths inside the container. Not sure what its purpose is. In debug mode, lando start reports this:

rootless-test 18:28:09
VERBOSE ==> perm sweeping flagged non-root containers ... 0=database
...
rootless-test 18:28:13
DEBUG ==> process pid8 running
/usr/share/lando/bin/docker-compose exec database /helpers/user-perms.sh cstdio=inherit, silent=false, mode=spawn, detached=false

Running perm_sweep() seems a little dangerous to me. I'd expect Lando not to do any changes to permissions / ownerships on my machine. But, the function runs the external home directory which is mounted by default. (I did verify this only with the debugging logs.)

---

P.S. I know, there are plans for Lando 4.x to have better support for rootless Docker and Podman. Hope this ticket helps building it.

[dev3encom]

I have Ubuntu 22.04 and lando do idem... chang permission on .lando and .ssh directory to 100999 user and group.

Docker 20.10 and Lando 3.6.4

[KorvinSzanto]

The way I got past this is I uninstalled rootless and switched back to the default context using:

dockerd-rootless-setuptool.sh uninstall -f
docker context use default

Then I set up my user to be in the docker group which is not ideal.

[SlimDeluxe]

Hi @stephang, it's been a year, have you been able to resolve this?

[stephang]

Hey @SlimDeluxe,

thanks for coming back to this issue. The problem remains and is not solved. I understood that the problem lies within Lando's core design and won't be fixed before a potential 4.x release.

In other words: you'll need root-ful Docker to enjoy a flawless Lando experience (as noted in @KorvinSzanto 's comment).

[adhershmnair]

I have an Ubuntu 22.04, and I'm also having the same issue, initially I was using the latest Lando version 3.18.0, and this was happening to all my project folders and also .ssh, .lando and git config folders and files. I downgraded to 3.6.4 and issue with my repositories gone, but the issue is still there with .ssh, .lando files in home directory.

Tried reinstalling Docker, Lando. But still I'm facing issue with this owner permission change to 100999 when running any lando commands like, lando rebuild, lando start.

[thetwentyseven]

I have resolved the issue installing Docker compose manually NOT the Docker Desktop.

[parijke]

Same issue here Lando v3.20.2 Docker 24.0.6 Docker Compose v2.20.3 Ubuntu 12.3.0-1ubuntu1~22.04

[DangDinhThi]

Hi @thetwentyseven, Can you list your config here? it may help other devs - includes me.

[thetwentyseven]

@DangDinhThi

Ubuntu: Ubuntu 22.04.3 LTS Docker version 24.0.6 Docker Compose: docker-compose version 1.26.1 Lando: v3.20.2

As I said before, do not install Docker Desktop in Ubuntu because it will install its own docker compose and it won't work. Install it separately .

[sagemike]

Uninstalling Docker desktop and installing docker compose manually worked for me

Lando v3.20.8 Docker 24.0.7 Docker Compose v2.21.0 Ubuntu 22.04.3 LTS