Support non-root users (runtime UID remapping)

.gitignore

@@ -1,4 +1,5 @@
 /lib
+code-server
 node_modules
 dist
 out

Dockerfile

@@ -34,14 +34,27 @@ RUN locale-gen en_US.UTF-8
 # configured in /etc/default/locale so we need to set it manually.
 ENV LC_ALL=en_US.UTF-8
 
-RUN adduser --gecos '' --disabled-password coder && \
+RUN addgroup --gid 1000 coder && \
+    adduser --uid 1000 --ingroup coder --home /home/coder --shell /bin/sh --disabled-password --gecos "" coder && \
 	echo "coder ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers.d/nopasswd
 
+RUN USER=coder && \
+	GROUP=coder && \
+	curl -SsL https://github.com/boxboat/fixuid/releases/download/v0.4/fixuid-0.4-linux-amd64.tar.gz | tar -C /usr/local/bin -xzf - && \
+	chown root:root /usr/local/bin/fixuid && \
+	chmod 4755 /usr/local/bin/fixuid && \
+	mkdir -p /etc/fixuid && \
+	printf "user: $USER\ngroup: $GROUP\n" > /etc/fixuid/config.yml
+
 USER coder
+
 # We create first instead of just using WORKDIR as when WORKDIR creates, the user is root.
-RUN mkdir -p /home/coder/project
+RUN mkdir -p /home/coder/workdir
+copy entrypoint.sh /home/coder/workdir/
+RUN sudo chmod +x /home/coder/workdir/entrypoint.sh
+
+WORKDIR /home/coder/workdir
 
-WORKDIR /home/coder/project
 
 # This assures we have a volume mounted even if the user forgot to do bind mount.
 # So that they do not lose their data if they delete the container.
@@ -50,4 +63,4 @@ VOLUME [ "/home/coder/project" ]
 COPY --from=0 /src/packages/server/cli-linux-x64 /usr/local/bin/code-server
 EXPOSE 8443
 
-ENTRYPOINT ["dumb-init", "code-server"]
+ENTRYPOINT ["dumb-init", "/home/coder/workdir/entrypoint.sh", "code-server"]

README.md

@@ -31,6 +31,32 @@ Use [sshcode](https://github.com/codercom/sshcode) for a simple setup.
 
 See docker oneliner mentioned above. Dockerfile is at [/Dockerfile](/Dockerfile).
 
+**Run as Non-root user dynamically mapped at runtime in docker**
+You can configure code server to run as a UID:GID of your choice. This uses the [boxboat/fixuid](https://github.com/boxboat/fixuid) utility to dynmaically remap the coder uid/gid at runtime. This is especially useful in environments where UIDs change, affect volume mount permissions, and process ownership. You can enable this feature easily with env variables, and the `docker -u` cli flag.
+
+WARNING: there are some concerns around [security](https://github.com/boxboat/fixuid/issues/1) with this approach, ensure you understand the implications
+
+Example 1: Run as the host UID:GID, by setting the FIXUID docker env var
+```bash
+docker run -it -p 127.0.0.1:8443:8443 \
+-v "${PWD}:/home/coder/project" \
+-u $(id -u):$(id -g) \
+-e FIXUID=y \
+codercom/code-server:latest --allow-http --no-auth
+```
+
+Example 2: Same as above, but disable the fixuid warning message
+```bash
+docker run -it -p 127.0.0.1:8443:8443 \
+-v "${PWD}:/home/coder/project" \
+-u $(id -u):$(id -g) \
+-e FIXUID=y \
+-e FIXUID_QUIET=y \
+codercom/code-server:latest --allow-http --no-auth
+```
+
+
+
 ### Binaries
 
 1.  [Download a binary](https://github.com/cdr/code-server/releases) (Linux and OS X supported. Windows coming soon)

entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/bash
+
+export HOME=/home/coder
+
+if [[ -z $FIXUID ]];
+ then 
+    echo "fixuid flag not set..."
+ else 
+    echo "fixuid is set..."
+    if [[ -z $FIXUID_QUIET ]];
+      then
+         fixuid
+      else
+         fixuid -q
+   fi
+fi
+
+echo "starting coder..."
+exec "$@"