Make image useable for non-root user about micromamba-docker HOT 6 CLOSED

To enable installing conda packages as root and then using them as an arbitrary non-root use, I think only the location/permissions for the file referenced by BASH_ENV needs to change. /opt/conda currently has permissions 755.

Setting BASH_ENV to /etc/bash.bashrc might be a good way to go.

from micromamba-docker.

Implemented in dc4bf68.

from micromamba-docker.

Hi @Midnighter -- thank you for your interest in Micromamba. Here is one approach that you could take:

FROM mambaorg/micromamba:0.12.0

RUN groupadd conda && \
        useradd --home-dir /home/conda --create-home --shell /bin/bash --skel /dev/null -g conda conda

RUN chown -R conda.conda /opt/conda

USER conda

ENV BASH_ENV /home/conda/.bashrc

RUN /bin/micromamba shell init -s bash -p $MAMBA_ROOT_PREFIX && \
        echo "micromamba activate base" >> ~/home/conda/.bashrc

I am working on updating the image to make this more straight forward, but I'm not sure when I'll get that wrapped up.

from micromamba-docker.

Thank you for the suggestion! If it's easier to outline what you have in mind than to actually do it, feel free to post it here and I can work on the changes.

from micromamba-docker.

FWIW, I was able to use a non-root user just by clearing BASH_ENV and bootstrapping the non-root user's .bashrc:

ENV BASH_ENV=
RUN /bin/micromamba shell init -s bash -p $MAMBA_ROOT_PREFIX && \
  echo "micromamba activate base" >> $HOME/.bashrc

from micromamba-docker.

Another interesting point on this topic would be to make the pre-installed tools available to any user. The scenario I describe is that I would create a Docker image derived from the micromamba image and install a couple of conda packages as root. Then I run that image with a non-root id, for example, docker run -u 1001:10001.

In order for any user id to be able to use the conda packages, the BASH_ENV should have permissions to be read by all (so maybe it should be in a different place), and /opt/conda would need read permissions for all, as well as binaries need to be executable by all.

I would do all of this in my derived image definition but I wanted to ask for your feedback if you think that's a decent approach.

from micromamba-docker.