Regression for running as non-root user? about shiny

[cboettig]

@rsynnest thanks for the report, we're trying to make the shiny container converge more to the rstudio stack, which will give greater flexibility. But it might mean we need a different execution pattern going forward for user mode. Can you try with the custom CMD:

EDIT (fixed path)

docker run --user shiny -p 3838:3838 --rm rocker/shiny /usr/bin/shiny-server

@noamross thoughts?

[rsynnest]

That did the trick! Initially it errored out due to the wrong filename, /usr/bin/shiny-server.sh just needs to be /usr/bin/shiny-server

[cboettig]

@rsynnest sweet, thanks for the report back and the correction. We'll try and get this added to the new docs.

cc @noamross

[noamross]

Yes, in the new architecture processes like Shiny or Rstudio are served by process supervisor that can only run as root. This has advantages for graceful interrupts and restarts, and if these processes are running concurrently. Shiny itself gives a startup message when running as root warning that this could be a security vulnerability. (The Pro version actually tries to downgrade its on permissions if it detects they are not necessary).

If you want shiny to run as non-root, the approach above, skips the process supervisor altogether. Alternatively, you can use a shiny configuration file to tell the shiny server what user it should run as detail here.

In addition to documenting this, we might take the following approaches:

• Have the shiny process run as user shiny by default
• Use an environment variable SHINY_USER to make it easy to set the shiny process user

[sneumann]

+1 for both ideas by @noamross to drop privileges early and have s6 init start the initial shiny process as shiny or whoever is in SHINY_USER, maybe following https://github.com/just-containers/s6-overlay#dropping-privileges and just-containers/s6-overlay#207 into the https://github.com/rocker-org/rocker-versioned2/blob/master/scripts/install_shiny_server.sh#L44
Yours, Steffen

[eitsupi]

This has been resolved by upgrading S6-overlay. rocker-org/rocker-versioned2#247