The root user inside the composer container

Question

I have a basic question when running Composer in a Docker container.

Is it possible to run composer as root inside a container? I am confused that the owner of the created files (for example, when using composer require ) is root .

Running as root inside a container in best practice?

Answer 1

Using root inside the container is fine, because the container has many privileges. It cannot access hardware or mount paths. This is essentially not a privileged user.

Installation of the application must be performed inside the container. Dockerfile that creates the image needs to install the application to start, and this happens inside the container. If you use a container to run a special application (e.g. php7) that is created using node, etc., the assembly container that performs the installation is the right way to isolate the application update and set the behavior from the host system.

In fact, nothing should run outside the container when deploying the application with Docker. Any cron scripts should run docker exec container script.sh or similarly to run periodic jobs inside the container, for example.

In general, if an application requires root privileges in order to do something like configuration-based update modules, I use docker-compose to install the build container, which does it all as root and then exits. I am using the cap-drop section for a real application container to remove as many features as possible.

Many applications require setuid or setgid to give up privileges - for example. nginx requires it to change from root to www-data:www-data . nginx will fail if it appears as a www-data user. The application should abandon these features after making the change itself.

Answer 2

The docker container should probably only be used to run the application. Everything that installs the application must run outside the container.

Usually you provide a configuration that points the container to production files stored somewhere. This will be the starting point for everything Composer has installed. The container itself should not have any write permissions anywhere, with the exception of any cache directory.