Fix permissions for rootless docker

[Dinth]

Hi. It looks like currently (at least) /tmp and /.cache folders are only writable to the root. This prevents container from running as a user (ie. "user:" option in docker-compose.

[vogler]

Hi! Have a look at #478. It works for fresh volumes, but now everyone has fgc volumes with data owned by root.
Not sure how to deal with it without making it too complicated.

[Dinth]

Hey. Im not advanced enough to build my own docker from the branch, but that what you described is basically the expected behaviour - after changing the user with an existing volume, it should require a chown -R done on the host to change permissions

[Dinth]

Ahhh, sorry i was thinking about setting my custom user with user: ":" in DC for extra security, but here you're changing the default user? It may be slightly tricky because you need root (and the relevant capabilities enabled) to change perms on the volumes

[vogler]

but here you're changing the default user?

Yes, root for apt-get install etc., the rest runs as fgc. You can probably still change it to some other user in docker-compose, but I think the user would have to exist in the image (or use uid/gid instead). Don't really know what's best here, but I think the main point is to not run node and the browser as root (which this PR should fix).

It may be slightly tricky because you need root (and the relevant capabilities enabled) to change perms on the volumes

This seems to work (alternatively do run it in some alpine image):

docker run --rm -it -v fgc:/fgc/data --user root ghcr.io/vogler/free-games-claimer chown -R fgc:fgc /fgc/data

Don't know how it influences bind-mounts (local directory instead of volume) or if nobody runs it that way anyway.

Since people will have to re-login with the change to patchright, they could also just create a new volume. However, then they would probably still want to copy their data/*.json files at least (history and keys).

[vogler]

Not running as root should also get rid of this "unsupported command-line flag" message in the browser: Kaliiiiiiiiii-Vinyzu/patchright#52

[zapl]

Not running as root but being able to change file permissions could be solved by giving the user passwordless sudo permissions.

Needs

• sudo installed
• an entry in /etc/sudoers (or a file in /etc/sudoers.d/)

example snippet

FROM debian:12 # ubuntu probably identical
# build args to customize the UID and GID of the user (to access host user files e.g. -v ./local:/container)
ARG UID=1000
ARG GID=1000
ARG USERNAME=user

# create a non-root user with the specified UID and GID, allow sudo
RUN <<EOF
    #!/bin/bash -e
    groupadd --gid "${GID}" "${USERNAME}"
    useradd --uid ${UID} --gid "${GID}" --shell /bin/bash --create-home --no-log-init "${USERNAME}"
    apt-get update
    apt-get install -y --no-install-recommends sudo
    rm -rf /var/lib/apt/lists/*
    echo "${USERNAME} ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers;
EOF
# then use that user to run the rest of the commands
# USER ${USERNAME}
# to switch back to root user
# USER root

scripts inside the container (e.g. entrypoint) can simply do sudo chown ... to fix the permissions