Run as non-root about uvicorn-gunicorn-docker

[Mazyod]

In order to run as non-root, I faced an issue binding gunicorn to (0.0.0.0, 80), but that was resolved once I realized I just need to bind to a non-privileged port, i.e. 8080. Otherwise, it was as simple as adding a USER directive in a Dockerfile.

[tiangolo]

Sure, you can do it if it's useful for your use case, but you have to make sure that the files in your local system belong to the correct user in your machine and then inside your container, that you have the right user inside as well, that the ownership of the files is correct, etc.

All this making sure that you use the right user ID number, if your local machine has more than one user, your user ID won't be the default one for a new user, etc.

Also, you lose the possibility to develop mounting a local volume with your code as the permissions probably won't match, or maybe you have to change them as part of your build step.

But if you are in a constrained environment or for some specific reason you want to run as another user, sure, you can do it, is just not something I can enforce or add defaults for it. For the same reasons above I can't make an assumption about the permissions and ownership of your code, nor about specific usernames, etc. Because each case that needs something similar will have different requirements, but for sure you can customize your own image to suit your needs, create the right user, set the right permissions to match your personal development environment, etc.

[github-actions]

Assuming the original issue was solved, it will be automatically closed now. But feel free to add more comments or create new issues.

[niloct]

Thanks @Mazyod for the lead.

I was experiencing a major headache with my issue, that I was getting Connection refused even with 8080 port and non-root.

My issue was that my gunicorn container was attached to TWO bridge networks, one for the database link and the other for nginx.

And guess in which network gunicorn was listening..... :(

Takeaway: specify HOST option with the full machine+network host name, like: impulse_python.docker_python_web_net (in my case)

(you can get values by docker network ls then docker network inspect [XXX] and the network suffix is the first Name value listed)