Fix docker build user (#35)

* use fixuid to dynamically map user/group permissions at runtime when the container is started

* update readme

* set username of docker run script as developer

* remove some packages from apt list as those are installed via apt or come in ros

* remove unused apt package python3-pytest

* Address comments

---------

Co-authored-by: JesusSilvaUtrera <jesus.silva@ekumenlabs.com>

Author: xaru8145

docker/Dockerfile

@@ -20,41 +20,49 @@ RUN apt-get update && apt-get install -y --no-install-recommends python3-pip &&
 # Initialize rosdep as root. Then regular users can rosdep update
 RUN rosdep init
 
-# Take ownership of the existing non-root user (ID 1000)
-ARG USERNAME=ros2
-ARG USER_UID=1000
-ARG USER_GID=1000
-
-# The Ubuntu 24 base image has a default user 'ubuntu' at UID/GID 1000.
-# We modify this user to match the host user's name.
-RUN apt-get update && apt-get install -y sudo \
-    && groupmod --gid $USER_GID --new-name $USERNAME ubuntu \
-    && usermod --uid $USER_UID --gid $USER_GID --login $USERNAME --home /home/$USERNAME --move-home ubuntu \
-    && echo "$USERNAME ALL=(ALL) NOPASSWD:ALL" > /etc/sudoers.d/$USERNAME \
-    && chmod 0440 /etc/sudoers.d/$USERNAME
+ARG USER=developer
+ARG GROUP=roscon
+
+RUN deluser ubuntu
+
+RUN addgroup --gid 1001 $GROUP \
+    && adduser --uid 1001 --ingroup $GROUP --home /home/$USER --shell /bin/bash --disabled-password --gecos "" $USER \
+    && adduser $USER sudo \
+    && echo "$USER ALL=NOPASSWD: ALL" > /etc/sudoers.d/$USER \
+    && chmod 0440 /etc/sudoers.d/$USER
+
+COPY docker/fixuid_config.yml /etc/fixuid/config.yml
+RUN /bin/bash -c '\
+     ARCH=`uname -m` && if [ "$ARCH" == "aarch64" ]; then FIXUID_ARCH="arm64"; else FIXUID_ARCH="amd64"; fi \
+  && curl -SsL https://github.com/boxboat/fixuid/releases/download/v0.6.0/fixuid-0.6.0-linux-$FIXUID_ARCH.tar.gz | tar -C /usr/local/bin -xzf - \
+  && chmod 4755 /usr/local/bin/fixuid \
+  && cd /etc/fixuid \
+  && sed -i "s/_USER_/$USER/" config.yml \
+  && sed -i "s/_GROUP_/$GROUP/" config.yml'
 
 # Worspace and work directory
-ENV WS=/home/${USERNAME}/ws
-RUN mkdir -p ${WS} && chown -R ${USER_UID}:${USER_GID} ${WS}
+ENV WS=/home/${USER}/ws
+RUN mkdir -p ${WS} && chown -R ${USER}:${GROUP} ${WS}
 WORKDIR ${WS}
 
 # Copy only package manifests first so this layer is cacheable even if source changes
 # The .dockerignore file excludes all source code so this layer stays small
 # and only rebuilds when manifests change.
-COPY --chown=${USERNAME}:${USERNAME} modules/ ${WS}/src/
+COPY --chown=${USER}:${GROUP} modules/ ${WS}/src/
 
 # Set the new user
-USER $USERNAME
+USER $USER:$GROUP
 
 # Install dependencies via rosdep
 SHELL ["/bin/bash", "-c"]
 RUN source /opt/ros/$ROS_DISTRO/setup.bash && \
     rosdep update && \
+    sudo apt-get update && \
     rosdep install --from-paths src --ignore-src -r -y
 
 # Source ROS 2 and colcon autocompletion on container startup
 RUN echo "source /opt/ros/$ROS_DISTRO/setup.bash" >> ~/.bashrc \
     && echo "source /usr/share/colcon_argcomplete/hook/colcon-argcomplete.bash" >> ~/.bashrc
 
-ENTRYPOINT ["/ros_entrypoint.sh"]
+ENTRYPOINT ["fixuid", "-q", "/ros_entrypoint.sh"]
 CMD ["bash"]

docker/README.md

@@ -6,6 +6,20 @@ It includes development tools, linters, Google Test/Mock, and all the necessary
 
 ## 🚀 Building the Image and Running the Container
 
+You can either build the **image locally** or pull it directly from **DockerHub**.
+
+### Pull from DockerHub (recommended)
+
+The prebuilt image is available at:
+
+```bash
+docker pull ekumenlabs/ros2-testing-workshop-roscon-es-25:jazzy
+```
+
+This is the easiest and fastest option.
+
+### Build the Image Locally
+
 To build the image, use the [build.sh](./build.sh) script provided in this repository:
 
 ```bash
@@ -25,6 +39,8 @@ It's possible to get information about the available flags for both scripts usin
 ./docker/run.sh --help
 ```
 
+## 📦 Container Usage
+
 Once the container is started, the entrypoint is located at the root of the ROS 2 workspace (~/ws).
 
 After shutdown, the user will be asked whether to save the changes made inside the container or not to the image (performing a `docker commit` internally).
@@ -37,5 +53,3 @@ docker exec -it ros2-testing-workshop-roscon-es-25-container bash
 
 > [!NOTE]
 > The name of the container might differ if a different name is provided in the script, so be careful about that.
-
-<!-- TODO: Add Troubleshoot section? Common problems? -->

docker/apt_packages.txt

@@ -6,15 +6,9 @@ python3-colcon-common-extensions
 python3-rosdep
 python3-vcstool
 
-# === Linters and formatters ===
-clang-format
-python3-pytest
-uncrustify
-
-# === Google Test (for C++ unit tests) ===
-libgtest-dev
-
 # === Quality of life tools ===
 curl
 wget
 nano
+vim
+sudo

docker/build.sh

@@ -62,9 +62,6 @@ fi
 echo "Building Docker image: ${IMAGE_NAME}:${TAG}"
 docker build \
   --platform "${PLATFORM}" \
-  --build-arg USERNAME="$(whoami)" \
-  --build-arg USER_UID="$(id -u)" \
-  --build-arg USER_GID="$(id -g)" \
   -f "${DOCKERFILE_PATH}" \
   -t "${IMAGE_NAME}:${TAG}" \
   "${CONTEXT_FOLDER_PATH}"

docker/fixuid_config.yml

@@ -0,0 +1,5 @@
+user: _USER_
+group: _GROUP_
+paths:
+  - /
+  - /home/_USER_/.ccache

docker/run.sh

@@ -2,7 +2,7 @@
 set -e
 
 # Configuration
-USERNAME=$(whoami)
+USERNAME=developer
 IMAGE_NAME="ekumenlabs/ros2-testing-workshop-roscon-es-25"
 ROS_DISTRO="jazzy"
 TAG="${ROS_DISTRO}"
@@ -113,6 +113,7 @@ xhost +
 
 # Run the container
 docker run -it \
+  --user=$(id -u):$(id -g) \
   --net=host \
   ${NVIDIA_FLAGS} \
   --name "${CONTAINER_NAME}" \