gui-docker with debian 12 bookworm and docker compose

[nghfp9wa7bzq]

Hello!
Thanks for this repo!
Recently I have used this for a project.
Here are the things I have changed.
They may be good info for you or for someone who is looking for a solution for the problem I had.
Note that there is a docker image with noVNC, but I'm not sure if that is better or not.

I have changed the image to python:3.9-bookworm.
I have changed the new user part to use docker ARGs and secrets:
Both should also be in the compose.yaml under the build schema.

  frontend:
    build:
      context: frontend
      target: runner
      secrets:
        - vnc-password
        - frontend-root-password
        - frontend-user-password
      args:
        - VNC_PASSWD_FILE=/run/secrets/vnc-password
        - DOCKER_ROOT_PASSWD_FILE=/run/secrets/frontend-root-password
        - DOCKER_USER_UID=1000
        - DOCKER_USER_NAME=docker
        - DOCKER_USER_PASSWD_FILE=/run/secrets/frontend-user-password

(Partial) Dockerfile:

ARG VNC_PASSWD_FILE
ARG DOCKER_ROOT_PASSWD_FILE
ARG DOCKER_USER_UID
ARG DOCKER_USER_NAME
ARG DOCKER_USER_PASSWD_FILE

# Add in non-root user
RUN useradd -m -s /bin/bash -d /home/${DOCKER_USER_NAME} -g users -G sudo -u ${DOCKER_USER_UID} ${DOCKER_USER_NAME}
#RUN chown -R ${DOCKER_USER_NAME}:users /home/${DOCKER_USER_NAME} && chown ${DOCKER_USER_NAME}:users /opt
RUN chown ${DOCKER_USER_NAME}:users /opt
SHELL ["/bin/bash", "-o", "pipefail", "-c"]
# password setup for root and docker user
RUN --mount=type=secret,required=true,id=frontend-root-password echo 'root:'$(cat $DOCKER_ROOT_PASSWD_FILE) | chpasswd
RUN --mount=type=secret,required=true,id=frontend-user-password echo ${DOCKER_USER_NAME}':'$(cat $DOCKER_USER_PASSWD_FILE) | chpasswd

# Create and save VNC password for docker user
RUN --mount=type=secret,required=true,id=vnc-password mkdir -p /home/${DOCKER_USER_NAME}/.vnc \
    && cat $VNC_PASSWD_FILE | vncpasswd -f > /home/${DOCKER_USER_NAME}/.vnc/passwd
RUN chown -R ${DOCKER_USER_NAME}:users /home/${DOCKER_USER_NAME}/.vnc

I have also added passwords for the docker user and root.
This probably should only be used for debugging.
I have moved the following line here from the container_startup.sh (to use docker secret)

mkdir -p $HOME/.vnc && echo "$VNC_PASSWD" | vncpasswd -f > $HOME/.vnc/passwd

I needed to add the following permissions to be able to run the startup scripts: (Dockerfile)

# Add execute permission
RUN chmod u+x /opt/container_startup.sh
RUN chmod u+x /opt/x11vnc_entrypoint.sh

In the container_startup.sh the VNC password is printed out by default.
This was removed for obvious security reasons.
Please check out these modifications and maybe implement them if you want.
Please keep this issue (you can close it of course), so that others may find this info.
Thank you.

[bandi13]

Wow, thank you so much for writing such a nice descriptive post. I'm glad my work was useful to you.

I think what you should do, is create a fork of this repo and make the changes you suggest. Then put a link to your repo in this thread so others can find it.

Storing a static password in the image is not something that I wanted to have (nor was Docker secrets a thing when I first created this). I want to have the ability to set a password each time I run the container. As a little backstory, a derivative of this container was used on a server where users could start their own instance and each would get a randomly generated password (so users won't be able to access each other's instance). Additionally, since this was running on a server, I didn't want users to have the ability to use sudo.

When using this container on other projects, I usually just pass -u root to the docker run command if I need root privileges.

The docker-compose.yml file is a good idea. I should put one in the repo.

[nghfp9wa7bzq]

Thanks for the reply.
I am sorry, but I don't have the time (or enough interest) to make this a full blown fork / repo.
However I may upload some version for my use-case if I have time to make some fixes.

(I wouldn't use sudo or root for production either.
My use case was to create an isolated environment for python gui development.
Elevated privileges were used to install / try components on the fly and then insert them into the Dockerfile later.
This saved me the time to recreate the containers all over again after every change.

Another thing, you can just insert the code to create sudo and add a root password, commented out, with a warning to not use them in production. If someone needs this feature, they can just uncomment it.
This would make your repo more universal. ;-))