[Feature] non-privileged user in Docker build

[piramiday]

Is your feature request related to a problem? Please describe.
at present, stash is running as root in the Docker container.

Describe the solution you'd like
ideally, a new non-privileged user should be created to execute stash, so that root permissions are dropped asap.

a non-root user for stash would agree with best practices and provide tighter security.
if possible, it would be great to be able to control both UID and GID of any created file.

[virusperfect]

I would love to see that feature as well. Either by allowing the --user option or by having environment variables PUID and PGID.

[jgramling17]

Can be potentially solved by the following:

services:
  stash:
    command: stash --config /config/config.yml
    ...
    environment:
      - USER=user
      - HOME=/config
    ...
    user: 1000:1000
    ...

I used this and it worked for a lot of use cases. There are some things that don't work when stash uses/edits system files that are owned by root.

Would love to see native support for this.

[virusperfect]

I am using hotio/stash and it works great with the PUID and PGID variables.

[DogmaDragon]

I am using hotio/stash and it works great with the PUID and PGID variables.

While that's an option, it's known to cause issues from time to time so use at your own risk.

[ikmckenz]

Added a $20 bounty to this issue on OpenCollective.

[WithoutPants]

$20 bounty assigned (txn number 725161)

[jgramling17]

I believe this causes issues with any scrapers that use py_common.

I recieved this in the logs during an attempted scrape:

scrapeSceneURL: input: scrapeSceneURL could not unmarshal json from script output: EOF
could not unmarshal json from script output: EOF
[Scrape / ManyVids] You need to install the python modules mentioned in requirements.txt
[Scrape / ManyVids] If you have pip (normally installed with python), run this command in a terminal from the directory the scraper is located: pip install -r requirements.txt

If you try and run the pip install -r requirements.txt command like it suggests
you will receive this error:
WARNING: The directory '/.cache/pip' or its parent directory is not owned or is not writable by the current user. The cache has been disabled. Check the permissions and owner of that directory. If executing pip with sudo, you should use sudo's -H flag.

TL;DR I think stash can't create the '/.cache/pip' directory without being root