I am trying to install uroni/urbackup-server [Docker] on my local rootless docker environment without success.
Can uroni/urbackup-server be installed in a rootless docker environment/container? Do I need to follow a different install procedure to?
I am getting some errors regarding what I understand are privilege issues and as a result it doesn’t start.
As per the instructions [UrBackup - Download UrBackup for Windows, GNU/Linux or FreeBSD] I installed with: docker run -d --name urbackup --restart unless-stopped -v /media/backups:/backups -v /media/database:/var/urbackup -p 55413-55415:55413-55415 -p 35623:35623/udp uroni/urbackup-server
The first time I installed, the installer gave me these errors and it didn’t finish.
docker: Error response from daemon: error while creating mount source path ‘/media/backups’: mkdir /media/backups: permission denied.
docker: Error response from daemon: error while creating mount source path ‘/media/database’: mkdir /media/database: permission denied.
creating the folders is not enough. The user inside the container must have permission to write it. You just created two folders using sudo which means you had to have root user to create. I don’t think you can expect those folders to be writable by a non-root user.
To whatever user which want to access it. If that user inside the container is root, then give access to your non-root user on the host. In case the user inside the container is something like “daemon” then give access to
231071 + UID of daemon
If it does not work try to run a container, bind mount a test folder from your home dir and use chown to change the owner of a file or folder, exit the container and check the owner of the file on your host.
The container has its own user namespace. In my environment the id outside the container was 231071 + uid inside. To tell the truth I tried rootless docker container the first time today and I am not sure what is the smallest ID on which system. This is why I recommended you to try it with a known user so you can find out the difference between the ID inside and outside. When you know the difference, you can try id USERIDINSIDE command from the container to see the username
This is the first time I use docker and set up a rootless container. It starts being a little bit confusing to me now.
Since it works the way it is now, I have to ask: why is it good to know what is the user behind the id that is now the owner of those folders on the host filesystem?
You wanted to know If you didn’t, then it was a misunderstanding. The only reason I wrote about looking for the username is that you needed to know which user (or ID) had to own the created folders. If you could find out the id without knowing the user inside the container, that’s fine.
I appreciate your responses because they put me in the right path, read and learnt a lot and made it work!
After some testing I can see that the container user “root” (0:0) maps to the host user “dockerUser” (1000:1000), which is the user running the docker daemon and the container. In the container, there is another user “urbackup” (1000:1000), which after some testing found out that it is the one that maps to the “100999” user in the host, that took ownership of the 2 directories I created in the beginning and then created additional sub-directories and files.
However, I am not sure why the “100999” user took that name. I would have expected that it would have been something like 101000. Is there a way to see these namepsace mappings created by docker?
I forgot to respond to your last question. I got the notification that you accepted my answer as a solution but I respond the last question now.
That is an ID not a name. Docker has an ID on the host to assign that to the root user inside the container, however, you see that ID from the container’s point of view as “0”. Obviously SMALLEST_ID + 0 is SMALLEST_ID. “daemon” inside the container has “2” as user id but only from the container’s point of view. You can see that from the host as SMALLEST_ID + 2. There is no
I don’t know where that smallest ID comes from but I had an LXD configuration which a could find while I was searching for the ID I had for the root user and LXD had the same ID for the root user. For Docker I could not find anything yet.
I can’t say that my settings is better than yours. It does not matter which ID was set for your environment. For security reason the smallest ID used by the user namespace should be larger then your biggest and actually used ID on the host. Maybe this is the difference between our environments.
If you didn’t, then it was a misunderstanding. The only reason I wrote about looking for the username is that you needed to know which user (or ID) had to own the created folders. If you could find out the id without knowing the user inside the container, that’s fine.