Being both nonprivileged and root inside Docker container
I want to use pandoc inside docker. The image looks like this:
FROM debian:buster-slim
RUN apt-get update && apt-get install -y pandoc texlive
WORKDIR /home
This is build.sh inside the project:
cp *.ttf /usr/local/share/fonts/ && fc-cache;
pandoc -o output.pdf input.md
that I want to run like this:
docker run --rm -t -v $(pwd):/home pandoc_container build.sh
This results in output.pdf being owned by root on my host. When doing:
docker run --user $(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
instead, the file will be owned by me, but the font files can not be copied to that dir, due to missing write permissions. Adding
RUN chmod a+w /usr/local/share/fonts/
to the Dockerfile solves this, but then the command fc-cache fails with a lot of failed to write cache errors also due to missing write permissions in lots of directories.
Copying the font files to ~/.fonts will not work either, because the user created by --user $(id -u) does not actually exist in the container:
I have no name!@0d9c6a272ae1:/home$
and thus does not have a home directory, which could be parsed by fc-cache.
What's an elegant way to solve this problem?
docker pandoc fontconfig
asked Dec 12 at 17:37
mcnesium
2842415
add a comment |
I want to use pandoc inside docker. The image looks like this:
FROM debian:buster-slim
RUN apt-get update && apt-get install -y pandoc texlive
WORKDIR /home
This is build.sh inside the project:
cp *.ttf /usr/local/share/fonts/ && fc-cache;
pandoc -o output.pdf input.md
that I want to run like this:
docker run --rm -t -v $(pwd):/home pandoc_container build.sh
This results in output.pdf being owned by root on my host. When doing:
docker run --user $(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
instead, the file will be owned by me, but the font files can not be copied to that dir, due to missing write permissions. Adding
RUN chmod a+w /usr/local/share/fonts/
to the Dockerfile solves this, but then the command fc-cache fails with a lot of failed to write cache errors also due to missing write permissions in lots of directories.
Copying the font files to ~/.fonts will not work either, because the user created by --user $(id -u) does not actually exist in the container:
I have no name!@0d9c6a272ae1:/home$
and thus does not have a home directory, which could be parsed by fc-cache.
What's an elegant way to solve this problem?
docker pandoc fontconfig
asked Dec 12 at 17:37
mcnesium
2842415
add a comment |
I want to use pandoc inside docker. The image looks like this:
FROM debian:buster-slim
RUN apt-get update && apt-get install -y pandoc texlive
WORKDIR /home
This is build.sh inside the project:
cp *.ttf /usr/local/share/fonts/ && fc-cache;
pandoc -o output.pdf input.md
that I want to run like this:
docker run --rm -t -v $(pwd):/home pandoc_container build.sh
This results in output.pdf being owned by root on my host. When doing:
docker run --user $(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
instead, the file will be owned by me, but the font files can not be copied to that dir, due to missing write permissions. Adding
RUN chmod a+w /usr/local/share/fonts/
to the Dockerfile solves this, but then the command fc-cache fails with a lot of failed to write cache errors also due to missing write permissions in lots of directories.
Copying the font files to ~/.fonts will not work either, because the user created by --user $(id -u) does not actually exist in the container:
I have no name!@0d9c6a272ae1:/home$
and thus does not have a home directory, which could be parsed by fc-cache.
What's an elegant way to solve this problem?
docker pandoc fontconfig
asked Dec 12 at 17:37
mcnesium
2842415
I want to use pandoc inside docker. The image looks like this:
FROM debian:buster-slim
RUN apt-get update && apt-get install -y pandoc texlive
WORKDIR /home
This is build.sh inside the project:
cp *.ttf /usr/local/share/fonts/ && fc-cache;
pandoc -o output.pdf input.md
that I want to run like this:
docker run --rm -t -v $(pwd):/home pandoc_container build.sh
This results in output.pdf being owned by root on my host. When doing:
docker run --user $(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
instead, the file will be owned by me, but the font files can not be copied to that dir, due to missing write permissions. Adding
RUN chmod a+w /usr/local/share/fonts/
to the Dockerfile solves this, but then the command fc-cache fails with a lot of failed to write cache errors also due to missing write permissions in lots of directories.
Copying the font files to ~/.fonts will not work either, because the user created by --user $(id -u) does not actually exist in the container:
I have no name!@0d9c6a272ae1:/home$
and thus does not have a home directory, which could be parsed by fc-cache.
What's an elegant way to solve this problem?
docker pandoc fontconfig
docker pandoc fontconfig
asked Dec 12 at 17:37
mcnesium
2842415
asked Dec 12 at 17:37
mcnesium
2842415
asked Dec 12 at 17:37
mcnesium
2842415
asked Dec 12 at 17:37
mcnesium
2842415
asked Dec 12 at 17:37
mcnesium
2842415
2842415
add a comment |
add a comment |
1 Answer
1
active
oldest
votes
The answer is as easy as adding
chown $UID output.pdf
to build.sh and then passing docker an env-var instead of the user id:
docker run -e UID=$(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
answered Dec 13 at 13:47
mcnesium
2842415
add a comment |
Your Answer
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "3"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383061%2fbeing-both-nonprivileged-and-root-inside-docker-container%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
1 Answer
1
active
oldest
votes
1 Answer
1
active
oldest
votes
active
oldest
votes
active
oldest
votes
The answer is as easy as adding
chown $UID output.pdf
to build.sh and then passing docker an env-var instead of the user id:
docker run -e UID=$(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
answered Dec 13 at 13:47
mcnesium
2842415
add a comment |
The answer is as easy as adding
chown $UID output.pdf
to build.sh and then passing docker an env-var instead of the user id:
docker run -e UID=$(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
answered Dec 13 at 13:47
mcnesium
2842415
add a comment |
The answer is as easy as adding
chown $UID output.pdf
to build.sh and then passing docker an env-var instead of the user id:
docker run -e UID=$(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
answered Dec 13 at 13:47
mcnesium
2842415
The answer is as easy as adding
chown $UID output.pdf
to build.sh and then passing docker an env-var instead of the user id:
docker run -e UID=$(id -u) --rm -t -v $(pwd):/home pandoc_container build.sh
answered Dec 13 at 13:47
mcnesium
2842415
answered Dec 13 at 13:47
mcnesium
2842415
answered Dec 13 at 13:47
mcnesium
2842415
answered Dec 13 at 13:47
mcnesium
2842415
2842415
add a comment |
add a comment |
Thanks for contributing an answer to Super User!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fsuperuser.com%2fquestions%2f1383061%2fbeing-both-nonprivileged-and-root-inside-docker-container%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
