How to configure Dockerfile for non-root user but give them access privileges to write to a file in the root dir?

Question

New to linux and working on containerizing our stack and essentially here is the problem that I am running into with the code below:

a) I have to execute this dockerfile as a non-root user for elastic search to work (requirement)

b)If I add USER $USERNAME to the bottom of the script before CMD i get the error: "mkdir: cannot create directory '/root': Permission denied Can not write to /root/.m2/copy_reference_file.log. Wrong volume permissions? Carrying on"

c) If I remove the USER $USERNAME from the bottom of the file then I get the elastic search issue referenced above.

What I am asking is, how can I fix this in my dockerfile?

# Custom image from Maven on DockerHub
# Language: dockerfile
FROM maven:3.6.3-amazoncorretto-8

# Set the working dir
WORKDIR /app

# Create a non root user
ARG USERNAME=jefferson
ARG USER_UID=1000
ARG USER_GID=$USER_UID

# Add linux dependenciesq
RUN yum install wget -y
RUN yum install shadow-utils -y

# Create the user
RUN groupadd --gid $USER_GID $USERNAME \
    && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME \
    && yum install sudo -y \
    && echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME \
    && chmod 777 /etc/sudoers.d/$USERNAME \
    && sudo groupadd docker \
    && sudo usermod -aG docker $USERNAME \
    && newgrp docker 

# Change to the root folder and edit the settings.xml for Maven
WORKDIR /root/.m2
RUN rm -rf settings.xml
RUN echo '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" \
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" \
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 \
http://maven.apache.org/xsd/settings-1.0.0.xsd"> \
</settings>' >> settings.xml

WORKDIR /app

COPY . ./

USER $USERNAME

# Run the application
CMD ["mvn", "clean", "verify", "-Pcargo.run", "-X"]

Answer 1

If i understand well your needs, on the official docker maven image you have a way to follow:

https://hub.docker.com/_/maven the header named

Running as non-root

with the following command line

docker run -v ~/.m2:/var/maven/.m2 -ti --rm -u 1000 -e MAVEN_CONFIG=/var/maven/.m2 maven mvn -Duser.home=/var/maven archetype:generate

it tells you to use a MAVEN_CONFIG env var and to add the -Duser.home= flag when calling maven

here is the full Dockerfile modified:

# Custom image from Maven on DockerHub
# Language: dockerfile
FROM maven:3.6.3-amazoncorretto-8

# Set the working dir
WORKDIR /app

# Create a non root user
ARG USERNAME=jefferson
ARG USER_UID=1000
ARG USER_GID=$USER_UID

# Add linux dependenciesq
RUN yum install wget -y
RUN yum install shadow-utils -y

ENV MAVEN_CONFIG=/var/maven/.m2

# Create the user
RUN groupadd --gid $USER_GID $USERNAME \
    && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME \
    && yum install sudo -y \
    && echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME \
    && chmod 600 /etc/sudoers.d/$USERNAME \
    && sudo groupadd docker \
    && sudo usermod -aG docker $USERNAME \
    && newgrp docker 

# Change to the root folder and edit the settings.xml for Maven
WORKDIR "/var/maven/.m2"
RUN rm -rf settings.xml \
    && chown $USER_UID:$USER_GID .
RUN echo '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" \
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" \
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 \
http://maven.apache.org/xsd/settings-1.0.0.xsd"> \
</settings>' >> settings.xml

WORKDIR /app

COPY . ./

USER $USERNAME

# Run the application
CMD ["mvn", "clean", "verify", "-Duser.home=/var/maven", "-Pcargo.run", "-X"]

the rights of the sudoers file you added was too permissive so i changed it to 600.