A user that can't modify `/app` can modify it when it is mounted

README.md

README

If you run this with docker-compose run --rm app, you are in bash inside of your Docker container. Now run:

touch lol.txt

Exit the shell. Now you can see the lol.txt. Check who is the owner. It is your own user.

Now do the same with docker build . and then docker run -it --rm .... You will get a permission denied.

Corollary

• We don't need to do any user mapping dance
• In the case of a Rails app, we can just COPY the entire directory as the root user and only provide read and execute permissions to our app user. We additionally provide write permissions to the tmp folder of the app. In production, the user is then not able to modify files on the FS, increasing security.
  • In development, it will still be possible to run things like rails g

docker-compose.yml

version: "3"
services:
  app:
    build:
      context: .
    volumes:
    - .:/app
    stdin_open: true
    tty: true

Dockerfile

FROM ruby:2.4

RUN useradd -m app && \
  mkdir /app

WORKDIR /app
USER app

CMD ["bash"]