docker-compose with minimal PID namespace and non-root permissions

Dockerfile

@@ -17,4 +17,8 @@ COPY --from=builder /app/build/bin/* /usr/local/bin/
 
 WORKDIR /var/lib/erigon
 
+RUN adduser -H -u 1000 -g 1000 -D erigon
+RUN chown -R erigon:erigon /var/lib/erigon
+USER erigon
+
 EXPOSE 8545 8546 30303 30303/udp 30304 30304/udp 8080 9090 6060

Makefile

@@ -9,6 +9,7 @@ GO_DBG_BUILD = go build -trimpath -tags=debug -ldflags "-X github.com/ledgerwatc
 
 GO_MAJOR_VERSION = $(shell go version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f1)
 GO_MINOR_VERSION = $(shell go version | cut -c 14- | cut -d' ' -f1 | cut -d'.' -f2)
+ERIGON_HOME = ~/.local/share
 
 all: erigon hack rpctest state pics rpcdaemon integration db-tools sentry
 
@@ -22,8 +23,12 @@ docker:
 	docker build -t turbo-geth:latest --build-arg git_commit='${GIT_COMMIT}' --build-arg git_branch='${GIT_BRANCH}' --build-arg git_tag='${GIT_TAG}' .
 
 docker-compose:
-	# Uses host's PID,UID,GID. It required to open Erigon's DB from another process (RPCDaemon local-mode)
-	UID_GID=$(shell id -u):$(shell id -g) docker-compose up
+	@if test -n "$(XDG_DATA_HOME)"; then \
+		mkdir -p $(XDG_DATA_HOME)/erigon $(XDG_DATA_HOME)/erigon-grafana $(XDG_DATA_HOME)/erigon-prometheus; \
+	else \
+		mkdir -p $(ERIGON_HOME)/erigon $(ERIGON_HOME)/erigon-grafana $(ERIGON_HOME)/erigon-prometheus; \
+	fi
+	docker-compose up
 
 # debug build allows see C stack traces, run it with GOTRACEBACK=crash. You don't need debug build for C pit for profiling. To profile C code use SETCGOTRCKEBACK=1
 dbg:

README.md

@@ -232,7 +232,7 @@ or
 XDG_DATA_HOME=/preferred/data/folder make docker-compose
 ```
 
-Makefile uses host's PID,UID,GID. It required to open Erigon's DB from another process (RPCDaemon local-mode).
+Makefile creates the initial directories for erigon, prometheus and grafana. The PID namespace is shared between erigon and rpcdaemon which is required to open Erigon's DB from another process (RPCDaemon local-mode).
 See: https://github.com/ledgerwatch/erigon/pull/2392/files
 
 Windows support for docker-compose is not ready yet. Please help us with .ps1 port

docker-compose.yml

@@ -6,8 +6,6 @@ services:
     image: thorax/erigon:latest
     build: .
     command: erigon --datadir=/var/lib/erigon --metrics --metrics.addr=0.0.0.0 --metrics.port=6060 --private.api.addr=0.0.0.0:9090 --pprof --pprof.addr=0.0.0.0 --pprof.port=6061
-    user: ${UID_GID:-1000:1000} # Uses host's PID,UID,GID. It required to open Erigon's DB from another process (RPCDaemon local-mode)
-    pid: host
     volumes:
       - ${XDG_DATA_HOME:-~/.local/share}/erigon:/var/lib/erigon
     ports:
@@ -19,7 +17,7 @@ services:
 
   prometheus:
     image: prom/prometheus:v2.28.1
-    user: ${UID_GID:-1000:1000}
+    user: 1000:1000 # Uses erigon user from Dockerfile
     command: --log.level=warn --config.file=/etc/prometheus/prometheus.yml --storage.tsdb.path=/prometheus --web.console.libraries=/usr/share/prometheus/console_libraries --web.console.templates=/usr/share/prometheus/consoles
     ports:
       - "9090:9090"
@@ -30,7 +28,7 @@ services:
 
   grafana:
     image: grafana/grafana:8.0.6
-    user: ${UID_GID:-1000:1000}
+    user: 1000:1000 # Uses erigon user from Dockerfile
     ports:
       - "3000:3000"
     volumes:
@@ -43,8 +41,7 @@ services:
   rpcdaemon:
     image: thorax/erigon:latest
     command: rpcdaemon --datadir /var/lib/erigon --private.api.addr=erigon:9090 --http.addr=0.0.0.0 --http.vhosts=* --http.corsdomain=* --http.api=eth,debug,net
-    user: ${UID_GID:-1000:1000} # Uses host's PID,UID,GID. It required to open Erigon's DB from another process (RPCDaemon local-mode)
-    pid: host
+    pid: service:erigon # Use erigon's PID namespace. It's required to open Erigon's DB from another process (RPCDaemon local-mode)
     volumes:
       - ${XDG_DATA_HOME:-~/.local/share}/erigon:/var/lib/erigon
     ports: