File ownership when running renku session with uid different from 1000

[rawlik]

When running a renku session on an own machine as a user whose id is not 1000, renku runs as root:

Your user id is not 1000 and for Jupyter to work the session must be started as root.
Jupyter itself will run as your user.

This leads to some problems, however.

Typically, most files on the host machine are owned by the regular user who ran the renku clone command. New files created in the renku session, though, are owned by root. This leads to an inconsistent ownership within the folder. I would expect that if, as a user, I clone a renku project, start a session and work in the session, in the end all the files in the directory are owned by me.

Second, git commands and, in consequence, renku save, don’t work in the session:

# git status
fatal: detected dubious ownership in repository at '/home/jovyan/work/gict-of-human-breast'To add an exception for this directory, call:git config --global --add safe.directory /home/jovyan/work/gict-of-human-breast

The user in the container is also root, and not jovyan.

According to the documentation of the docker stacks one should set the correct username, group name, uid and gid with
-e NB_USER=<username> -e NB_UID=<numeric uid> -e NB_GROUP=<name> -e NB_GID=<numeric gid> or --user <numeric uid> --group-add users.

Related to #3321

[Panaetius]

I tried the settings you posted in your documentation and while they work with the base jupyter images, the changes we do on top of them for renku prevent them from working. The only way I could get it working at all was with running as root.

I think this is the script that ultimately does the changes necessary, but for some reason those don't work in our docker files, even though from what I could tell, the start.sh script does get executed.

It is not clear to me what causes this issue and how it could be fixed.

@olevski @rokroskar maybe you have an idea?

[Panaetius]

Timeboxed to 3 days

[rokroskar]

@Panaetius I'm pretty sure we don't execute start.sh anywhere?

[Panaetius]

The base jupyter image executes it through the start-notebook.sh which I think we do run somewhere. When I looked into this originally I changed our entrypoint to call that script directly but that also didn't work.