2023.01.26 First Two weeks with Fedora Silverblue 37: docker uid issues - GlenKPeterson/One-off_Examples GitHub Wiki

2 weeks ago I switched my desktop to Fedora Silverblue. I love the idea that the core OS is immutable. That all apps, and I think even GNOME, is installed as a flatpak. I liked the idea of doing development in containers and was able to successfully set up openvpn, ssh, and git along with specific versions of the JVM and my development environment in a podman container. It turns out Fedora toolboxes only run fedora-based distros.

Google Chrome seems pretty happy in a flatpak - the only thing I can't do so far is share my entire screen in Google Meet, only a window or a tab at a time. Zoom, Steam, they all work just fine in flatpaks on an immutable host OS.

Where I ran into trouble is docker. podman is supposed to be command-line compatible with docker. It probably was, before docker-compose. But podman seems designed to run containers temporarily as the current user, where docker is more a machine-wide, restart-automatically-on-reboot mindset. Docker also maybe plays nicer with Ubuntu/Debian distros than with Fedora ones.

Specifically, the mysql docker container hard-codes a mysql user as uid 999. On Ubuntu, I ensure my host OS has a uid and gid 999. I call it mysql because that just makes sense. File and OS permissions all just work out. On Fedora Silverblue, uid 999 is given to ssh. I had to remap to host uid 27, which was a pain. Permissions issues abounded. This might work, but I feel like I'm the first or second person doing this.

Now I need to choose:

  1. Install docker on my existing Silverblue installation with os-tree install? It's against the immutable OS way, but could potentially simplify things, letting me use docker-compose, for instance. Probably won't affect my uid assumptions/issues though.
  2. Do a fresh install of Ubuntu 22.04
    • Run unsnap
    • Copy my Documents and Pictures folders

Option 1 is easiest to try, but option 2 is more likely to meet my expectations. The immutable host OS may have to wait for another day.

UPDATE Since docker rootless came out, the whole host-to-guest uid mapping hack has become obsolete. This all might work in Silverblue just fine, but I chose option 2 and got things working there instead.