当前位置： 文江博客 话题详情

如何确保Docker内部和外部的用户保持一致？

发布于 2025-02-08 10:37:20 字数 4529 浏览 2 评论 0 原文

我正在制作Docker图像。我想在那里有一个现成的环境以及一些现成的目录。这样，我只需要安装一些目录并直接使用它们即可。我使用下面的Dockerfile制作了图像。为了在容器内外拥有相同的权限（不是root），我创建了一个用户用户。

FROM matthewfeickert/docker-python3-ubuntu:latest

USER root
# Create an arbitrary non-root user; we don't care about its uid
# or other properties
RUN useradd --system user

RUN sudo pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple

RUN set -x; \
        sudo  apt-get update \
        && DEBIAN_FRONTEND=noninteractive sudo  apt-get install -y  build-essential git-core m4 zlib1g zlib1g-dev libprotobuf-dev protobuf-compiler libprotoc-dev libgoogle-perftools-dev swig xz-utils gdb git \
        && sudo -H python3  -m pip install scons==3.0.1 \
        && sudo -H python3  -m pip install six  


# RUN apt-get -y install gdb

RUN apt-get clean

RUN git config --global url."https://hub.fastgit.xyz/".insteadOf "https://github.com/"

WORKDIR /usr/local/src

RUN git clone https://github.com/gem5/gem5.git

RUN sudo chown user /usr/local/src/gem5 -R

USER user

# RUN mkdir -p /usr/local/src/gem5/build

# RUN sudo chown user /usr/local/src/gem5/build 

WORKDIR /usr/local/src/gem5/

制作图像后，我将目录安装到其中。

docker run  -it --rm  \
-v my_dir/runScripts:/usr/local/src/gem5/runScripts   \
-v my_dir/gem5/src:/usr/local/src/gem5/src  \
-v my_dir/gem5/configs:/usr/local/src/gem5/configs \
-v my_dir/gem5/programs:/usr/local/src/gem5/programs 
-v my_dir/gem5/build:/usr/local/src/gem5/build  \
-v my_dir/gem5/results:/usr/local/src/gem5/results \
-v my_dir/gem5/update.sh:/usr/local/src/gem5/update.sh  \
--security-opt seccomp=unconfined --user 1000:1000 gerrie/gem5:v1  "/bin/bash"

当我进入Docker容器时，我此时输出UID。

$ echo $UID
1000

这与容器外部相同。

我认为GEM5目录的内部和外部应该是完全相同的用户。但这不是。

$ ll
total 232
drwxr-xr-x  1 user   root    4096 Jun 16 09:12 ./
drwxr-xr-x  1 root   root    4096 Jun 16 03:16 ../
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 .git/
-rw-r--r--  1 user   root     984 Jun 16 03:17 .git-blame-ignore-revs
-rw-r--r--  1 user   root     645 Jun 16 03:17 .gitignore
-rw-r--r--  1 user   root   19339 Jun 16 03:17 .mailmap
-rw-r--r--  1 user   root    5595 Jun 16 03:17 CODE-OF-CONDUCT.md
-rw-r--r--  1 user   root   26112 Jun 16 03:17 CONTRIBUTING.md
-rw-r--r--  1 user   root    2332 Jun 16 03:17 COPYING
-rw-r--r--  1 user   root    1478 Jun 16 03:17 LICENSE
-rw-r--r--  1 user   root    7790 Jun 16 03:17 MAINTAINERS.yaml
-rw-r--r--  1 user   root    2133 Jun 16 03:17 README
-rw-r--r--  1 user   root   34435 Jun 16 03:17 RELEASE-NOTES.md
-rwxr-xr-x  1 user   root   28876 Jun 16 03:17 SConstruct*
-rw-r--r--  1 user   root    8616 Jun 16 03:17 TESTING.md
drwxrwxr-x  2 docker docker  4096 Jun 16 08:52 build/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 build_opts/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 build_tools/
drwxrwxr-x 13 docker docker  4096 Jun 16 08:54 configs/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 ext/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 include/
drwxrwxr-x  2 docker docker  4096 Jun 16 09:03 programs/
-rw-rw-r--  1 docker docker     0 Jun 16 08:58 results
drwxrwxr-x  2 docker docker  4096 Jun 16 02:33 runScripts/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 site_scons/
drwxrwxr-x 17 docker docker  4096 Jun 16 02:33 src/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 system/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 tests/
-rw-rw-r--  1 docker docker     0 Jun 16 08:58 update.sh
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 util/

我安装的所有目录都属于 docker 用户，所有其他目录均为用户。 我能够在安装的目录中创建文件。但是对于Gem5的目录，我什至没有权限创建文件。 但是根据DockFile的说法，我显然已经将此目录转换为用户。进入容器时，我设置 uid 。

docker@7df3004beb2a:/usr/local/src/gem5$ touch test
touch: cannot touch 'test': Permission denied
docker@7df3004beb2a:/usr/local/src/gem5$ cd runScripts/
docker@7df3004beb2a:/usr/local/src/gem5/runScripts$ touch test
docker@7df3004beb2a:/usr/local/src/gem5/runScripts$ ll
total 8
drwxrwxr-x 2 docker docker 4096 Jun 16 09:13 ./
drwxr-xr-x 1 user   root   4096 Jun 16 09:12 ../
-rw-r--r-- 1 docker docker    0 Jun 16 09:13 test

当我编译时，此问题就会发生。我认为这是由许可问题引起的。我哪里出错了？我应该如何修改它？多谢！

filenotfounderror：[errno 2]没有这样的文件或目录：“/usr/usr/local/src/gem5/fatal：unsafe repository（'/usr/usr/local/src/src/gem5'由其他人拥有）此目录的例外，请致电：\ n \ n \ tgit config -global -global -add safe.directory/usr/local/src/src/gem5/hooks'：

原文

I am making a Docker image. I would like to have a ready-made environment in there as well as some ready-made directories. In this way, I only need to mount some of my directories and use them directly. I made the image using the Dockerfile below. In order to have the same permissions inside and outside the container (not root), I created a user user.

FROM matthewfeickert/docker-python3-ubuntu:latest

USER root
# Create an arbitrary non-root user; we don't care about its uid
# or other properties
RUN useradd --system user

RUN sudo pip config set global.index-url https://pypi.tuna.tsinghua.edu.cn/simple

RUN set -x; \
        sudo  apt-get update \
        && DEBIAN_FRONTEND=noninteractive sudo  apt-get install -y  build-essential git-core m4 zlib1g zlib1g-dev libprotobuf-dev protobuf-compiler libprotoc-dev libgoogle-perftools-dev swig xz-utils gdb git \
        && sudo -H python3  -m pip install scons==3.0.1 \
        && sudo -H python3  -m pip install six  


# RUN apt-get -y install gdb

RUN apt-get clean

RUN git config --global url."https://hub.fastgit.xyz/".insteadOf "https://github.com/"

WORKDIR /usr/local/src

RUN git clone https://github.com/gem5/gem5.git

RUN sudo chown user /usr/local/src/gem5 -R

USER user

# RUN mkdir -p /usr/local/src/gem5/build

# RUN sudo chown user /usr/local/src/gem5/build 

WORKDIR /usr/local/src/gem5/

After making the image, I mount my directory into it.

docker run  -it --rm  \
-v my_dir/runScripts:/usr/local/src/gem5/runScripts   \
-v my_dir/gem5/src:/usr/local/src/gem5/src  \
-v my_dir/gem5/configs:/usr/local/src/gem5/configs \
-v my_dir/gem5/programs:/usr/local/src/gem5/programs 
-v my_dir/gem5/build:/usr/local/src/gem5/build  \
-v my_dir/gem5/results:/usr/local/src/gem5/results \
-v my_dir/gem5/update.sh:/usr/local/src/gem5/update.sh  \
--security-opt seccomp=unconfined --user 1000:1000 gerrie/gem5:v1  "/bin/bash"

When I enter the docker container, I output the UID at this time.

$ echo $UID
1000

This is the same as outside the container.

What I think is that the inside and outside of the gem5 directory should be exactly the same user. But it's not.

$ ll
total 232
drwxr-xr-x  1 user   root    4096 Jun 16 09:12 ./
drwxr-xr-x  1 root   root    4096 Jun 16 03:16 ../
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 .git/
-rw-r--r--  1 user   root     984 Jun 16 03:17 .git-blame-ignore-revs
-rw-r--r--  1 user   root     645 Jun 16 03:17 .gitignore
-rw-r--r--  1 user   root   19339 Jun 16 03:17 .mailmap
-rw-r--r--  1 user   root    5595 Jun 16 03:17 CODE-OF-CONDUCT.md
-rw-r--r--  1 user   root   26112 Jun 16 03:17 CONTRIBUTING.md
-rw-r--r--  1 user   root    2332 Jun 16 03:17 COPYING
-rw-r--r--  1 user   root    1478 Jun 16 03:17 LICENSE
-rw-r--r--  1 user   root    7790 Jun 16 03:17 MAINTAINERS.yaml
-rw-r--r--  1 user   root    2133 Jun 16 03:17 README
-rw-r--r--  1 user   root   34435 Jun 16 03:17 RELEASE-NOTES.md
-rwxr-xr-x  1 user   root   28876 Jun 16 03:17 SConstruct*
-rw-r--r--  1 user   root    8616 Jun 16 03:17 TESTING.md
drwxrwxr-x  2 docker docker  4096 Jun 16 08:52 build/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 build_opts/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 build_tools/
drwxrwxr-x 13 docker docker  4096 Jun 16 08:54 configs/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 ext/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 include/
drwxrwxr-x  2 docker docker  4096 Jun 16 09:03 programs/
-rw-rw-r--  1 docker docker     0 Jun 16 08:58 results
drwxrwxr-x  2 docker docker  4096 Jun 16 02:33 runScripts/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 site_scons/
drwxrwxr-x 17 docker docker  4096 Jun 16 02:33 src/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 system/
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 tests/
-rw-rw-r--  1 docker docker     0 Jun 16 08:58 update.sh
drwxr-xr-x  1 user   root    4096 Jun 16 03:17 util/

All the directories I mount belong to the docker user, and all other directories are user.
I am able to create files inside my mounted directory. But for gem5's directory, I don't even have permission to create files.
But according to the Dockfile, I have clearly chown this directory to user. And when entering the container, I set the uid.

docker@7df3004beb2a:/usr/local/src/gem5$ touch test
touch: cannot touch 'test': Permission denied
docker@7df3004beb2a:/usr/local/src/gem5$ cd runScripts/
docker@7df3004beb2a:/usr/local/src/gem5/runScripts$ touch test
docker@7df3004beb2a:/usr/local/src/gem5/runScripts$ ll
total 8
drwxrwxr-x 2 docker docker 4096 Jun 16 09:13 ./
drwxr-xr-x 1 user   root   4096 Jun 16 09:12 ../
-rw-r--r-- 1 docker docker    0 Jun 16 09:13 test

When I compile, this problem occurs. I think this is caused by a permissions issue. Where did I go wrong? How should I modify it? Thanks a lot!

FileNotFoundError: [Errno 2] No such file or directory: "/usr/local/src/gem5/fatal: unsafe repository ('/usr/local/src/gem5' is owned by someone else)\nTo add an exception for this directory, call:\n\n\tgit config --global --add safe.directory /usr/local/src/gem5/hooks":

如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

扫码二维码加入Web技术交流群

发布评论

需要 登录 才能够评论， 你可以免费 注册 一个本站的账号。

评论（1）

落墨 2025-02-15 10:37:20

由于问题被标记为 podman （除了 docker ），这是对主机和容器之间映射用户映射的问题的解决方案：

如果您想将您的常规用户映射到主机上的用户，在容器内使用相同的UID，您可以添加Podman选项 -userns = keep-id 。可以在故障排除中找到一个更通用的解决方案（在UID不相同时也可以工作） -container-creates-a-a-file-th-in-not by-by-the-user-regular-uid“ rel =“ nofollow noreferrer”>提示和提示。这些技巧可以利用选项 - uidmap 和 -gidmap 。 （我写了这些提示）。

这两个选项 - uidmap 和 - gidmap 可能看起来有些复杂，但是一旦您了解无根的podman映射uid和gids，它将是如何的非常直截了当。

As the question was tagged with podman (in addition to docker), here is a Podman solution to the problem of mapping users between the host and the container:

If you want to map your regular user on the host to a user with the same UID inside the container, you could add the Podman option --userns=keep-id. A more general solution (that also works when the UIDs are not the same) can be found in the troubleshooting.md tip and tip. The tips make use of the options --uidmap and --gidmap. (I wrote those tips).

The two options --uidmap and --gidmap may look to be a bit complicated to use, but as soon as you understand how rootless Podman maps UIDs and GIDs it will be pretty straight forward.

回复 原文
~没有更多了~

关于作者

岁吢

暂无简介

文章
评论
27 人气
发私信

相关话题

更多

热门标签

操作系统 程序设计 IT运维 Linux系统管理 JavaScript 服务器应用 solaris C/C++ PHP Shell BSD Vue.js aix Oracle Python HTML 系统管理 HTML5 CSS 前端
更多

推荐作者

alipaysp_snBf0MSZIv

文章 0 评论 0

梦断已成空

文章 0 评论 0

瞎闹

文章 0 评论 0

凯凯我们等你回来

文章 0 评论 0

寄意

文章 0 评论 0

似梦非梦

文章 0 评论 0

更多

友情链接

文江博客
    我们使用 Cookies 和其他技术来定制您的体验包括您的登录状态等。通过阅读我们的 隐私政策 了解更多相关信息。 单击 接受 或继续使用网站，即表示您同意使用 Cookies 和您的相关数据。
    原文