Replies: 2 comments 9 replies
-
|
I guess it does look hardcoded to 1000:1000 Is this intentional? Is there a reason I shouldn't/couldn't change this to 1001:1001 for my case? https://github.com/mbround18/valheim-docker/blob/main/src/scripts/entrypoint.sh |
Beta Was this translation helpful? Give feedback.
-
|
@wesgould The given bash commands STEAM_UID=${PUID:=1000} and STEAM_GID=${PGID:=1000} are setting default values for STEAM_UID and STEAM_GID variables if they aren't already set. This can be expanded into if statements as follows: if [ -z "${PUID}" ]; then
PUID=1000
fi
if [ -z "${PGID}" ]; then
PGID=1000
fi
STEAM_UID=$PUID
STEAM_GID=$PGIDIf you would like to learn more about bash expansion read here: https://www.gnu.org/software/bash/manual/html_node/Shell-Parameter-Expansion.html. its a short hand way of writing |
Beta Was this translation helpful? Give feedback.
-
|
However, i can look into the shell and enforce that its looking for the correct variables |
Beta Was this translation helpful? Give feedback.
-
|
Looks like when i changed the current user from root to steam it blocks the usermod logic for updating the user ids. looking into a fix rn |
Beta Was this translation helpful? Give feedback.
-
|
@wesgould can you test #788 with the container |
Beta Was this translation helpful? Give feedback.
-
|
right nowi have it update the group so its accessible to steam at 1000 and the group at what ever your number is |
Beta Was this translation helpful? Give feedback.
-
|
So that seems to work, but I was trying avoid having my user account used at all (since it has elevated privileges). Ideally it would be valheim valheim since valheim is my non-privileged account just for this container. What would happen if you hardcoded the PUID=1001? Does it "steam" have to be 1000 to work? |
Beta Was this translation helpful? Give feedback.
-
|
in this current configuration i cannot change the puid, is it possible you can add your user id to the valheim group? |
Beta Was this translation helpful? Give feedback.
-
|
@wesgould wanted to check in |
Beta Was this translation helpful? Give feedback.
-
|
I'd welcome anyone smarter than me re: security best practices, but my understanding is that one of the best practices for docker containers is having a separate user (on the host) for each container--where those users are limited in what they can do (eg non-privileged accounts/can't read or write or execute any other files on the system). If an exploit or bug allowed access to the host from the docker, that access would be from whatever permissions the 'user' uid has to write to the host. With that said, I dont think the solution above solves/meets the intent of that. So while it gets rid of the error, it still makes uid 1000 the owner of the files, and I think it most people's cases thats going to be their main user account that likely has sudo privileges. I'd be happy to help dig into the code to see where the dependencies on uid 1000 are. There should be a way to make the container write to the host as a different UID/GID than from whatever the container uses internally. This is the most performant valheim docker server so I'd love to help fix that. |
Beta Was this translation helpful? Give feedback.
-
|
Hey @wesgould, i have a background & degree in adv cyber security and wanted to chine in with this. The container was running as root which is user 0 in the container. This is seen as not a good practice and so the user was moved to the steam user. I change this to be the steam user which is at Here is the best practices guides: https://docs.docker.com/develop/security-best-practices/ If you truly want isolation and security for your containers and docker host through unique users via a user per container. This is what you are talking about and how to do user namespace remapping: https://docs.docker.com/engine/security/userns-remap/ Ideally, if you want to enforce a specific user ID without having to remap user the docker features and best practices, the container itself is very lightweight and can be extended via: https://www.phind.com/search?cache=ftjumt3pf9k4r7n6at6n0bue FROM mbround18/valheim:latest
ARG USER_ID=1001
ARG GROUP_ID=1001
USER steam
USER root
RUN usermod -u $USER_ID steam && groupmod -g $GROUP_ID steam
RUN chown steam:steam /home/steam
USER steam |
Beta Was this translation helpful? Give feedback.
-
I am running into weird permission issues if I try to pass in the PUID and PGID Environment variables to the container. It appears as though the PUID is being passed properly but the PGID might not be.
Here is my compose file:
My server has my personal user at 1000:1000 and this valheim user at 1001:1001
if I do docker-compose up (with or without --build) it starts to launch but I get lots of permission denied errors:
If I run this, with my valheim (1001:1001) user without any PUID or PGID args it creates a structure where the directory and files are all 1000:1000 aka my regular user account owns them. BUT IT WORKS*. I just want all of these files/directories and everything to be owned by my valheim 'service' account that I created for additional security.
I think the steam user inside the container is running at 1000:1000 by default and it seems to not like it if you pass the variables.
What am I doing wrong? I am sure its something super dumb on my end, but maybe its a bug?
For what its worth I search for an answer, saw this #18 and #23 but nothing in there seemed to point me in the right direction other than it seems like it was fixed years ago?
Beta Was this translation helpful? Give feedback.
All reactions