search

mediagis / nominatim-docker

100% working container for Nominatim
Creative Commons Zero v1.0 Universal
1.09k stars 444 forks source link

rootless container #510

Open devthejo opened 10 months ago

devthejo commented 10 months ago

Is your feature request related to a problem? Please describe. I want to run it on a kubernetes cluster that doesn't allow root containers, so I want to be able to run it as non root

Describe alternatives you've considered Tried to play with security context to override uid, but fail with missing permissions on folders and port that is <1024 and require privileges

Additional context I've fixed this here https://codeberg.org/devthefuture/nominatim-docker-rootless/src/branch/master/Dockerfile if you're OK to accept a PR on this, I will do one.

another topic ;-) : concerning your issue https://github.com/mediagis/nominatim-docker/blob/a8fff59378c2ba3fa5d18e6dfdcd5eab03fc2645/4.3/Dockerfile#L143 the trick is to put an ARG at the top of Dockerfile (before any stage/FROM) with the default value, then call ARG again but without value in the stage, it will be usable as variable in the stage with the default (or build-arg value) from the top one:

ARG NOMINATIM_VERSION=4.3.2
FROM ubuntu:jammy AS build
# ...
FROM scratch
ARG NOMINATIM_VERSION
ENV NOMINATIM_VERSION=$NOMINATIM_VERSION
ENV USER_AGENT=mediagis/nominatim-docker:$NOMINATIM_VERSION