forked from retoor/devplacepy
26 lines
1.1 KiB
YAML
26 lines
1.1 KiB
YAML
 
|
# Rootless-podman overlay for this host (no docker daemon here).
|
||
|
|
#
|
||
|
|
# The base file runs the app as `user: 1000:1000`. Under rootless podman the
|
||
|
|
# default userns maps container uid 1000 to a subordinate host uid (100999),
|
||
|
|
# which cannot write the bind-mounted checkout (owned by host uid 1000), so
|
||
|
|
# uvicorn crashes on startup with PermissionError and nginx never starts.
|
||
|
|
# Running as container root maps back to the invoking host user (retoor),
|
||
|
|
# restoring write access. This stays unprivileged on the host because the
|
||
|
|
# container is rootless.
|
||
|
|
#
|
||
|
|
# (A `userns_mode: keep-id` service override was tried first, but podman
|
||
|
|
# rejects `--userns` together with `--pod`, and podman-compose places all
|
||
|
|
# services in one pod.)
|
||
|
|
#
|
||
|
|
# Kept as an overlay (not inlined) so rootful `docker compose` keeps using
|
||
|
|
# the non-root app user from the base file.
|
||
|
|
#
|
||
|
|
# Usage (prefer the make targets - a bare `up` without this file recreates a
|
||
|
|
# crashing app, see PODMAN.md):
|
||
|
|
# make podman-up
|
||
|
|
# podman-compose -f docker-compose.yml -f docker-compose.podman.yml up -d
|
||
|
|
|
||
|
|
services:
|
||
|
|
app:
|
||
|
|
user: "0:0"
|