會想到要紀錄這個主要是因為最近在使用 docker 架設 reviewboard，看到 reviewboard 的 Dockerfile 有個這樣的設定

# Review Board user ID
#
# The web server will run as this user, and writable directories (such as
# htdocs/media/uploaded/ and data/) will be owned by this user.
ARG REVIEWBOARD_USER_ID=1001

# Review Board group ID
#
# Writable directories (such as htdocs/media/uploaded/ and data/) will be owned
# by this group.
ARG REVIEWBOARD_GROUP_ID=1001

.
.
.

# Create a user for the web server.
RUN    groupadd -r reviewboard -g $REVIEWBOARD_GROUP_ID \
    && adduser --system --uid $REVIEWBOARD_USER_ID \
               --disabled-password --disabled-login \
               --ingroup reviewboard reviewboard

由於 reviewboard 的 docker-compose 設定檔使用 nginx 處理 html、圖片等靜態網頁檔案等 ...

所以 nginx docker container 必須要能存取 reviewboard docker container 所產生的靜態網頁資料。

reviewboard 的作法是將 host 的某個資料夾同時掛到 nginx 與 reviewboard 底下，然後讓 nginx 的 docker container 與 reviewboard docker container 使用相同的 UID:GID - 1001:1001，這樣 nginx 就能存取 reviewboard 產生的檔案了。

docker container run --rm -it \
  -v $(app):/app \                          # Mount the source code
  --workdir /app \                          # Set the working dir
  --user $(id -u):$(id -g) \                        # Run as the given user
  my-docker/my-build-environment:latest \   # Our build env image
	  make assets                               # ... and the command!

執行指令的時候帶入環境變數

CURRENT_UID=$(id -u):$(id -g) docker-compose up

# This is an abbreviated example docker-compose.yml
version: '3.3'
services:
  rspec:
    image: my-docker/my-build-environment:latest
    environment:
      - RAILS_ENV=test
    command: ["make", "assets"]
    # THIS BIT!!!1!
    user: ${CURRENT_UID}
    volumes:
      - .:/app

Just a moment...

https://medium.com/redbubble/running-a-docker-container-as-a-non-root-user-7d2e00f8ee15

https://medium.com/redbubble/running-a-docker-container-as-a-non-root-user-7d2e00f8ee15