Docker + Celery tells me not to run as root, but once I don't, I lack permissions to run

user_10572532 0
Viewed 8009

I have a Django (2.1.2) Docker project that I try to include Celery (4.2.1) which will exit 0 in the end due to permission errors.

docker-compose.yml

...
celery:
  build: .
  command: celery worker -A core --workdir /opt/services/web_app/src -l info
  volumes:
    - .:/opt/services/web_app/src
  depends_on:
    - database1
    - redis

After i build with 'docker-compose build' and then run 'docker-compose up' I get this error message:

celery_1  | /usr/local/lib/python3.7/site-packages/celery/platforms.py:796:
celery_1  | RuntimeWarning: You're running the worker with superuser privileges: this 
celery_1  | is absolutely not recommended!
celery_1  |
celery_1  | Please specify a different user using the --uid option

So.. I didn't even know Docker had "users" so I added this to my 'Dockerfile' at the bottom before expose.

...
RUN groupadd -g 999 celery && \
    useradd -r -u 999 -g celery celery
USER celery

EXPOSE 8000

and then updated the 'Dockerfile' with the user:

...
celery:
  build: .
  command: celery worker -A core --workdir /opt/services/web_app/src -l info --uid=celery
  volumes:
    - .:/opt/services/web_app/src
  depends_on:
    - database1
    - redis

and when I run it now I get error message:

celery_1  | File "/usr/local/lib/python3.7/site-packages/celery/platforms.py", line 502,
celery_1  | in initgroups return os.initgroups(username, gid)
celery_1  | PermissionError: [Errno 1] Operation not permitted
docker celery permissions django python
2 Answers
  1. If you want to specify a uid, you use the multi command, not worker, and you run the multi command as root. If you want to use worker just run the command without uid.
  2. You can also just set the C_FORCE_ROOT env variable to 1 and run this as root in docker if this is just for local development.

n.b., you may also need to update file permissions in case your celery task writes anything to the filesystem (like log files, or temp files).

user_60431700

Change your Dockerfile:

WORKDIR /app
RUN useradd -ms /bin/bash celery
COPY . /app
RUN chown -R celery:celery /app
USER celery

And set C_FORCE_ROOT=false

Or, you can force container to run as non-user:

docker run --user 1000 -v /root/secrets.txt:/tmp/secrets.txt <img>
user_28407140
Related