Inconsistent Atlantis Uid Between the Alpine and Debian Docker Images

[X-Guardian]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you!
• Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.

---

Overview of the Issue

The uid of the atlantis user is inconsistent between the Alpine and Debian Docker images. This causes confusion, especially when using EFS storage where the Atlantis user uid and gid need to be specified.

• Alpine atlantis uid: 100
• Debian atlantis uid: 1000

Reproduction Steps

> docker run -it ghcr.io/runatlantis/atlantis:v0.27.0-alpine /bin/bash           
No files found in /docker-entrypoint.d/, skipping
35b5e044d9f8:/$ id
uid=100(atlantis) gid=1000(atlantis) groups=1000(atlantis)

> docker run -it ghcr.io/runatlantis/atlantis:v0.27.0-debian /bin/bash
No files found in /docker-entrypoint.d/, skipping
atlantis@60eb0755faae:/$ id
uid=1000(atlantis) gid=1000(atlantis) groups=1000(atlantis)

[jamengual]

that is expected, in debian new users start at 1000 and alpine is different. and since we released debian from day 1 like that we decided not to change it.

…

On Thu, Dec 21, 2023, 1:22 p.m. Simon Heather ***@***.***> wrote: Community Note - Please vote on this issue by adding a 👍 reaction <https://blog.github.com/2016-03-10-add-reactions-to-pull-requests-issues-and-comments/> to the original issue to help the community and maintainers prioritize this request. Searching for pre-existing feature requests helps us consolidate datapoints for identical requirements into a single place, thank you! - Please do not leave "+1" or other comments that do not add relevant new information or questions, they generate extra noise for issue followers and do not help prioritize the request. - If you are interested in working on this issue or have submitted a pull request, please leave a comment. ------------------------------ Overview of the Issue The uid of the atlantis user is inconsistent between the Alpine and Debian Docker images. This causes confusion, especially when using EFS storage where the Atlantis user uid and gid need to be specified. - Alpine atlantis uid: 100 - Debian atlantis uid: 1000 Reproduction Steps > docker run -it ghcr.io/runatlantis/atlantis:v0.27.0-alpine /bin/bash No files found in /docker-entrypoint.d/, skipping 35b5e044d9f8:/$ id uid=100(atlantis) gid=1000(atlantis) groups=1000(atlantis) > docker run -it ghcr.io/runatlantis/atlantis:v0.27.0-debian /bin/bash No files found in /docker-entrypoint.d/, skipping ***@***.***:/$ id uid=1000(atlantis) gid=1000(atlantis) groups=1000(atlantis) — Reply to this email directly, view it on GitHub <#4087>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQ3ERAC3GTV5LAL6ZZW3KLYKRO27AVCNFSM6AAAAABA6UPSG2VHI2DSMVQWIX3LMV43ASLTON2WKOZSGA2TENZRHEYTEMI> . You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

[X-Guardian]

OK. I suggest this detail is added to the documentation as it is not obvious looking at the dockerfile and causes confusion like in terraform-aws-modules/terraform-aws-atlantis#382.

[jamengual]

good point, I'm away now but I will try to get to this next week.

…

On Fri, Dec 22, 2023, 6:46 a.m. Simon Heather ***@***.***> wrote: OK. I suggest this detail is added to the documentation as it is not obvious looking at the dockerfile and causes confusion like in terraform-aws-modules/terraform-aws-atlantis#382 <terraform-aws-modules/terraform-aws-atlantis#382> . — Reply to this email directly, view it on GitHub <#4087 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAQ3ERCULGUMIBEXSY3G4ELYKVJIRAVCNFSM6AAAAABA6UPSG2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMYTQNRXGQ3TAMJTGU> . You are receiving this because you commented.Message ID: ***@***.***>

[nitrocode]

We could also specify the uid to always be 100 to make them consistent. I say 100 since alpine was the first image that was supported by atlantis and we introduced debian fairly recently so fewer are using debian. If we went this route, it would be a breaking change so it would need to be added to the next minor release with notes in the release documentation.

https://stackoverflow.com/a/23602838

Alpine uses useradd which has a -u flag

-u, --uid UID
The numerical value of the user's ID. This value must be unique, unless the -o option is used. The value must be non-negative. The default is to use the smallest ID value greater than 999 and greater than every other user. Values between 0 and 999 are typically reserved for system accounts.

atlantis/Dockerfile

Lines 184 to 186 in 0b51afc

	RUN useradd --create-home --user-group --shell /bin/bash atlantis && \
	chown atlantis:root /home/atlantis/ && \
	chmod u+rwx /home/atlantis/

Debian uses adduser (same as useradd but with beginner friendliness)

atlantis/Dockerfile

Lines 142 to 146 in 0b51afc

	# Set up the 'atlantis' user and adjust permissions
	RUN addgroup atlantis && \
	adduser -S -G atlantis atlantis && \
	chown atlantis:root /home/atlantis/ && \
	chmod u+rwx /home/atlantis/

---

We should probably use useradd for both and set -u 100 for consistency. This way there is nothing to document other than the user id for all supported container types.

[ferpizza]

The only caveat with using uid 100 is that the debian image is already using that uid for sshd

$ docker run -it ghcr.io/runatlantis/atlantis:latest-debian /bin/sh
No files found in /docker-entrypoint.d/, skipping
$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
sshd:x:100:65534::/run/sshd:/usr/sbin/nologin
atlantis:x:1000:1000::/home/atlantis:/bin/bash

The cleaner way I can think of to fix the debian container is to remove openssh-server package (that will in turn remove the sshd user) and then create the atlantis user forcing it to use uid = 100

I can gladly add a PR for this, if some maintainer can approve this draft idea