failed switching to "root" on restart

[TiiFuchs]

This problem was posted before in #226 I think.

When a Docker container is restarted (like the host server is rebooted or the docker-ce gets updated and restarts everything) every container based on (at least) webdevops/php-nginx:7.4 can't start.
The error message is
error: failed switching to "root": operation not permitted

I use these in production, so it's really annoying to do docker-compose down && docker-compose up -d on every restart of everything (or these containers). I forget it all the time and have downtimes I don't like.

Since it's an awesome package of everything I need for my software, I'd like to continue the use of it, but this error is really annoying.

There was an fix in #333 I guess, but as I read it, it was reverted shortly after. So the problem is still there. (At least for me...)

Any chance we find a fix for it? Sadly I don't understand why this error appears. So I have no idea. :(

[htuscher]

The basic problem is your intention to run the container as non-root user. There's no real reason to do that.
The container should be started without a user specified, so it starts as root and can start supervisord etc. without any issues.
Everything inside the container is still tied to the application user 1000 even if you get SSH into the container etc. there's no issue.
Only thing, when running docker exec without --user application you are root and if the container is privileged you could damage the host system. But if you can execute docker exec anyway you way too far into the system already.

Yes the fix in #333 didn't work and broke lots of other things.

Many docker images don't support being run as non-root user btw.

[TiiFuchs]

Yeah I have an USER application in my Dockerfile waht extends the php-nginx image).
Mainly because the application files all are owned by "application" and I wanted it to be simple to call docker-compose exec <container> bash and be that user... (Also my own entrypoint needs to be called from that user because of those rights).

Is the only way to call all that with --user application or could I achieve this in another way?

[htuscher]

We usually do

COPY --chown 1000:1000 src /app

The container runs as root

And if we have to go into the container we use docker exec -ti --user application (we have shell aliases for that)

Or if you enter the shell without --user you can use su application.

Or if you just want to execute a command you can use docker exec -i container gosu application /app/something

[TiiFuchs]

Okay, thanks.
I will adjust my Dockerfile accordingly! 👍

[plakidan]

My problem resolve is: remove "user" from docker-compose.yaml

 php-fpm:
  image: webdevops/php-nginx:7.1
  volumes:
    - type: bind
      source: "/path/to/site/root"
      target: "/var/www/html" 
  user: application <--- REMOVE THIS LINE
  restart: always
  environment:
    WEB_DOCUMENT_ROOT: "/var/www/html"

[xavier83ar]

Do you know why it works the first time, when the container is created? I've set the user in docker-compose file, and it runs without issues if I do a docker-compose down after every execution.
So, it only fails when restarting an existing container, I don't know what's the difference between restarting an existing one and creating it, but clearly the image can be run as non-root user... then the container can't be restarted though.

[remotemerge]

We usually do

COPY --chown 1000:1000 src /app

The container runs as root

And if we have to go into the container we use docker exec -ti --user application (we have shell aliases for that)

Or if you enter the shell without --user you can use su application.

Or if you just want to execute a command you can use docker exec -i container gosu application /app/something

COPY --chown=1000:1000 src /app