Adding uid and gid to docker job how?

I am trying to deploy a container, that needs to r/w to a bind mount on the host that has permission of a specific user. In bare metal docker you can specify a uid to run the container as. Please tell me this is possible with nomad. If not I have to dump this whole project using nomad.

Brad

Hey @bradley :wave:

You can use the user attribute for the task to configure the user that the workload runs as. I am not sure that there is a way to set the group for a task, however.

Hope that this can get you unbound.

Regards,
Charlie

Ok that looks like it might work… whew… I was worried. Now to find an example of how to specify the value… not sure if it is a number (uid) or an actual host username.

Brad

When I was peeking at the code, it looks like we pass that whole value to the eventual Docker API call. So it would end up being resolved there I would expect (but I have not directly tested) that you can use ay of the forms allowed by the --user flag.

Excerpted from the Docker Run docs:

-u="", --user="": Sets the username or UID used and optionally the groupname or GID for the specified command.

The followings examples are all valid:
--user=[ user | user:group | uid | uid:gid | user:gid | uid:group ]

The one thing I seem to remember when using users, docker, and a Nomad host volume was that numbers were far more stable than usernames because I think that Nomad uses them locally on the host and Docker uses them inside the container. Here’s a link to my earlier experiments with docker, users, and host volumes which might give you some ideas.

I’m eager to hear how it goes for you.

Best,
Charlie

@bradley, I was able to do a quick test with that scenario, and I verified that you can set the effective UID:GID with the user value. So hopefully this gets you off to the races. :racehorse:

Regards,
Charlie

Thank you very much for doing this… this is above and beyond what I expected for community support.

Brad

1 Like