thoughts on running container using root GUID and PUID 0

[jata1]

Really love this project and I'm a happy user over many years. So thanks to all involved and especially haugene!

I have recently switched all my docker configs (compose) to use a dedicated user - so no longer using root.

I noticed a couple of errors in the log when starting transmission with the dedicated user account. It still starts and works fine so this is not an issue really.

Just want to know what other users do - run as root or with a dedicated docker account?

[moonraker2]

How did you set up the dedicated user?
Did you allow it to login or not, and did you set a password for it?

[moonraker2]

I don't have much success starting transmission-openvpn when changing from root to newly created "transmission" user:

[jata1]

I have this container working using a standard user account. It is a long time ago but these are the things you need to do/check.

Make sure the local config folder (and also the data/download folder) and all files (recursively) are 'owned' by the required user account

I would suggest that you use docker compose as it is much easier to config containers this way. Below is an example of my compose for this container. Hopefully it helps you.

services:
  transovpn:
    image: haugene/transmission-openvpn:latest
    container_name: transovpn
    restart: unless-stopped
    cap_add:
      - NET_ADMIN
    security_opt:
      - seccomp:unconfined
    logging:
      driver: json-file
      options:
        max-size: 10m
    ports:
      - 9091:9091
    dns:
      - 8.8.8.8
      - 8.8.4.4
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /symlinks/omv-system/appdata/transovpn/config:/config
      - /symlinks/media/import:/data
    environment:
      - OPENVPN_PROVIDER=[vpn provider]
      - OPENVPN_USERNAME=[user]
      - OPENVPN_PASSWORD=[pwd]
      - DISABLE_PORT_UPDATER=false  # change to true if having issues with port forwarding
      - LOCAL_NETWORK=192.168.1.0/24
      - OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60
      - PUID=[user id for user e.g. 1000]
      - PGID=[group id for user e.g. 100]
      - TZ=[your timezone]

[moonraker2]

First, thank you for replying back to this old thread :)

I have now managed to get the container to run under a separate, non-privileged PUID, following your guidance.

A couple of questions. though:

In my docker compose file I have not included "seccomp:unconfined" directive, since it seems that sort of negates the purpose of running the container with a non-root user?
Can you enlighten me why you are including this? The container seems to run fine, without it.

What is the purpose of the openvpn options "OPENVPN_OPTS=--inactive 3600 --ping 10 --ping-exit 60" ?

Do you know of any additional steps that one could take, to lock down / secure the docker container?