It's good practice to run processes within a container as a non-root user with restricted permissions. Even though containers are isolated from the host operating system, they do share the same kernel as the host. Also, processes within a container should be prevented from writing to where they shouldn't be allowed to as extra protection against exploitation. Running a Docker process as a non-root user has been a Docker feature as of version 1.10. To run a Docker process as a non-root user, permissions need to be accounted for meticulously. This permission adjustment needs to be done when building a Dockerfile. You need to be aware of where in the filesystem your app might write to, and adjust the permissions accordingly. Since everything in a container is considered disposable, the container process really shouldn't be writing to too many locations once build. Here is an annotated example of how you might create a Dockerfile where the process that runs within runs a
In trying to define my ideal Docker and Django development setup, I've been looking for a solution to the following needs: I've often found the need to install my project's private Git repositories into Docker container via a standard requirements.txt file. I also want to easily develop on those private Git repositories, in addition to the Git repo main project repository that contains my Django project. As you've probably encountered, a standard pip requirements file for installing both pypi packages and private Git repos might look something like the following. # requirements.txt django=1.11.3 -e git+git@github.com:my_github_user/repo_1.git#egg=my_project1 -e git+git@github.com:my_github_user/repo_2.git@my_branch@egg=my_project2 If you are not using Docker and you run pip install -r requirements.txt inside of a virtualenv, pip will download pypi packages (in this case Django) into the lib/python3.x/site-packages/ directory of your virtualenv and wil