Consider run service as non-root user.

[libook]

Thank AbdBarho for maintaining this.
I just tried this, and it works very well. Pictures were generated with root user and root group. I have to do chown to operating them as normal users. So I have added lines into services/AUTOMATIC1111/Dockerfile before WORKDIR to let it run as a non-root user:

RUN \
  # There is already a group named users with GID 100
  useradd -m -u 1000 -g users -o -s /bin/sh user && \
  mkdir /output /data && \
  chown -R user:users /output /data $ROOT
USER user

(Also use ARG to customize UID and GID.)

And I have modified services/AUTOMATIC1111/entrypoint.sh to switch home directory:

-MOUNTS["/root/.cache"]="/data/.cache"
+MOUNTS["/home/user/.cache"]="/data/.cache"

Would this be a good idea?

[AbdBarho]

@libook I agree it is a good idea to run as non-root.

However, this will cause problems when working with extensions, installing additional dependencies, or wanting to customize the behaviour.

[izackv]

I believe that running a Linux docker (on a Windows machine) with a UID of 1000 should work without issues.
If this is the case, we can set the user on the x-base-service to user: "${UID}", and in the bash to set the ${UID} to the current user ID, while in the power shell, just set it to 1000.
Unfortunately, I can't check it myself, since I don't have access to any windows machine, but it sounds like a quick test.
--- Edit:
If anyone can verify that windows will work with the above solution, I can write it, test it on Linux and make a pull request.

[izackv]

I don't think that Windows should be a problem.
I just changed the yml file with the following addition:

x-base_service: &base_service
    user: "${USER_ID:-0:0}"

This way, the user can set the USER_ID environment variable.
But if no one sets this variable, Docker will use the default (0:0), which should be OK.

To run the file from windows, use the current way.
To run the file from Linux and force the current user ID on the docker, just use the following starting bash script:

#!/bin/bash
 if [ "$#" -ne  "1" ]
   then
     echo "usage: $ ./run.sh [ download | auto | auto-cpu | invoke | sygil | sygil-sl ]"
 else
     USER_ID=$(id -u):$(id -g) docker compose --profile $1 up --build
 fi

Since I need this change for myself anyway, I created a pull request with those changes.

[AbdBarho]

we might need a migration script that allows access for "old" files to non-root users.

[izackv]

My code set the container permissions to the current user, but we must fix some issues using a non-root user.
I will investigate that.
We might need to change the entrypoint.sh script and others.

[AbdBarho]

please don't invest a huge amount of time in this issue, it is secondary for this repo.

Unless you want it for yourself.