Advanced Version Control docker permission issues

Ignition
,
1

I am setting up a CI/CD Pipeline. I am quite at the begging but some work has been done. At our main servers we have podman quadlets, orchestrated by systemd. We access the named volumes [Volume=ign-data:/usr/local/bin/ignition/data] from a helper container [docker.io/alpine/git]. So there are no permission issues.

We are versioning entire data directory with an .gitignore file. Namely ignition.conf is ignored as it contains the dev mode of given gateway.

Now I am trying to create a docker compose so each developer can run it and work on his own local machine (Win, Mac, Linux…). And I did run into multiple issues but it melts down to permissions.

The Ignition process in the container runs with uid=2003. But the files in a bind mounted volume has some other uid.

How do I allow users to mount a directory with the git controlled config files? So the ignition is using the files and the user can use regular user space tools for managing the files?

And even better, can I have a single docker compose or what ever script that sets this up for a user to use?

services:
  ignition-db:
    image: timescale/timescaledb:latest-pg14
    ports:
      - "19432:5432"
    environment:
      PGDATA: /pgdata
      POSTGRES_PASSWORD: setPass
      TZ: Europe/Prague
      PGTZ: Europe/Prague
    volumes:
      - ign-db-pgdata:/pgdata
      - ign-db-postgresql:/var/lib/postgresql/data
      - ../sql/initDB.sql:/docker-entrypoint-initdb.d/initDB.sql:ro
    restart: always
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres -q"]
      interval: 3s
      timeout: 5s
      retries: 10
      start_period: 90s
    networks:
      default:
        aliases:
          - ignition-db

  ignition:
    image: inductiveautomation/ignition:8.3.4
    depends_on:
      ignition-db:
        condition: service_healthy
    ports:
      - "19088:8088"
      - "19060:8060"
      - "19542:62542"
    environment:
      ACCEPT_IGNITION_EULA: Y
      GATEWAY_ADMIN_USERNAME: admin
      GATEWAY_ADMIN_PASSWORD: setPass
      IGNITION_EDITION: standard
      TZ: Europe/Prague
      GATEWAY_MODULES_ENABLED: com.inductiveautomation.opcua,com.inductiveautomation.perspective,com.inductiveautomation.opcua.drivers.siemens,com.inductiveautomation.symbol-factory,com.inductiveautomation.historian,com.inductiveautomation.opcua.drivers.tcpudp,com.inductiveautomation.sfc,com.inductiveautomation.jdbc.postgresql,com.inductiveautomation.historian.sql,com.inductiveautomation.jdbc.mariadb,com.inductiveautomation.opcua.drivers.siemens-symbolic,com.inductiveautomation.opcua.drivers.modbus,productiongateway,batchgateway,tracegateway,qualitygateway,webservicegateway,businessconnectgateway,com.inductiveautomation.webdev
    volumes:
      - ign-data:/usr/local/bin/ignition/data
      - ../../config:/usr/local/bin/ignition/config
      - ../../projects:/usr/local/bin/ignition/projects
    restart: always

volumes:
  ign-db-pgdata:
  ign-db-postgresql:
  ign-data:
2

This is probably not best practice, but I have been setting the user as root given that it is developers working on projects and not running in production. I am not concerned about giving a docker container higher privileges when it is just a developer running a container on their local machine.