Docker container fails when running with host user (-u)

[julibeg]

I'll try to explain the problem to the best of my ability:

Per default, the user in a Docker container is root. This entails that any files created in mounted directories by commands run in the container are owned by root and can only be read by other users, not written to. To get around this, many people are adding -u $(id -u) to their docker run command.

However, this user does not exist in the container and thus does not have a default shell. The container will therefore fall back to using /bin/sh. Crucially, the env variable SHELL is set at this stage and, as you might be aware, shells don't set SHELL themselves (SHELL is set on login; i.e. if you start bash from another shell it won't set SHELL to /bin/bash; it will just inherit the SHELL env variable from the previous shell; you can test this by running SHELL=bla bash -c 'echo $SHELL'). Taken together, this means that, when the user runs

docker run \
  -v ${INPUT_DIR}:${INPUT_DIR} \
  -v ${OUTPUT_DIR}:${OUTPUT_DIR} \
  -u $(id -u):$(id -g) \
  hkubal/clair3:latest \
  /opt/bin/run_clair3.sh \
  ... other options ...

they will get the following error:

/opt/bin/scripts/clair3_c_impl.sh: 121: readarray: not found

This is because the following happens:

• the container starts off using sh since there is no default shell for the user $(id -u); this sets SHELL to /bin/sh
• /opt/bin/run_clair3.sh is run by bash, but SHELL is still /bin/sh
• in run_clair3.sh you use ${SHELL} to invoke /opt/bin/scripts/clair3_c_impl.sh

  Clair3/run_clair3.sh

  Line 346 in 21e7ead

  ${SHELL} ${SCRIPT_PATH}/scripts/${CLAIR3_SCRIPT} \

• /opt/bin/scripts/clair3_c_impl.sh is run by /bin/sh which lacks the bash built-in readarray and thus fails

To fix this, I would suggest calling ${SCRIPT_PATH}/scripts/${CLAIR3_SCRIPT} without ${SHELL} (i.e. just ${SCRIPT_PATH}/scripts/${CLAIR3_SCRIPT} ... options ... since the other scripts all have shebang lines anyway.

[aquaskyline]

Thank you, Julian for figuring out the details. We switched to using ${SHELL} to support Mac that doesn't have bash installed, but overlooked the issue when running docker with -u. We will propose a fix in the next release.

[julibeg]

great, thanks!

[aquaskyline]

fixed in v1.0.0