opensafely-core / stata-docker

Builds the opensafely stata docker image.
0 stars 0 forks source link

Support running as non-root user #18

Closed bloodearnest closed 1 year ago

bloodearnest commented 1 year ago

Previously, we relied on various paths inside the image that required root privileges to read or write. Specifically:

  1. We need to write the env var supplied license to /usr/local/stata/stata.lic. This is handle via symlink
  2. We used the /root/entrypoint.sh - this has been move to /usr/local/bin/entrypoint.sh
  3. We shipped various core libraries in /root/ado/plus, which is one of the default per-user locations. Apart from the path permissions, the 'plus' package namespace is often used by users in their own code[1]. So instead, switch to /usr/local/ado, the default SITE location, which a) is outside /root/ and b) matches our intended usage, and is b/w compat with users using their own PLUS or PERSONAL paths in analysis code.
  4. We autoload ./libraries/*.ado, which is now done as the user running the command, so need to also work non-root. For now, to avoid further collisions with use of PLUS, we add them to the SITE dir. This did require making the SITE dir world writable, so that we can link into it.

Given the changes above, added test coverage for both the stata libraries shipped with the docker image, as well as studies with ./libraries/.