Updated docker-compose.yml to restrict capabilities and privileges of containers

[zaniyah]

I have added the statements that I believe are needed, but have not had time to test it properly, yet.

[zaniyah]

I merged the latest OCW changes into my fork and re-opened the draft PR.

Currently this is the error I am seeing with things as they are:

server-1  | PermissionError: [Errno 13] Permission denied: '/app/logs/tcuserver.log'

But I had that before I made these changes, so I do not think it is related.

[zaniyah]

Indeed, something is not right with file ownership, and this causes the write issues.

c74714a0ad6c:/app$ ls -l logs
total 4
-rw-r--r--    1 1000     1000            66 Aug 23 17:11 tcuserver.log
c74714a0ad6c:/app$ whoami
ocw
c74714a0ad6c:/app$ id 
uid=5000(ocw) gid=5000(ocw) groups=5000(ocw)
c74714a0ad6c:/app$ 

[developerfromjokela]

I merged the latest OCW changes into my fork and re-opened the draft PR.

Currently this is the error I am seeing with things as they are:

server-1  | PermissionError: [Errno 13] Permission denied: '/app/logs/tcuserver.log'

But I had that before I made these changes, so I do not think it is related.

Log directory needs to have same permissions as docker container, I think that's the cause. If you do chown -R 5000:5000 for log dir

[zaniyah]

I think the USER ocw line needs to come after the COPY --chown lines, so that an extra chown is not required (in the Dockerfile).

[zaniyah]

Alternatively we could use userid/groupid variables in .env so that the local user matches.

[zaniyah]

This error does not affect the changes to docker-compose.yml and is a local configuration issue (the user running docker does not match the UID/GID currently hard-coded in this and the Dockerfile). Perhaps another issue & PR for fixing that. I think it is less urgent.

[developerfromjokela]

Hi. Tested the change, nothing seems broken and it's working overall.

One thing if you could do, regarding carwings directory. For push notifications (and future-proofing), APNS needs a certificate file. The old way was to keep it in carwings directory. Now that only settings is mounted, could there be another mounted directory (named resources, files, or something else) for this exact purpose?

Otherwise it's looking good!