Running docker image as non-root

[ptr727]

I'm trying to run all my docker images that don't need to be root as a non-root user.
When I run this image as non-root, I get access denied errors.

Is there a simple solution, what about mounting /etc/postfix external with permissions matching the user?
Sidenote; also wondering if mounting external volumes could also be used to persist delayed mail while upgrading the container, e.g. when watchtower applies an upgrade and mail is pending?

Logs:

Setting configuration option maillog_file with value: /dev/stdout
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option myhostname with value: smtp.home.insanegenius.net
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option mydomain with value: insanegenius.net
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option mydestination with value: localhost
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option myorigin with value: $mydomain
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option relayhost with value: [smtp.gmail.com]:587
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_use_tls with value: yes
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_sasl_auth_enable with value: yes
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_sasl_password_maps with value: lmdb:/etc/postfix/sasl_passwd
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_sasl_security_options with value: noanonymous
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option always_add_missing_headers with value: no
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_host_lookup with value: native,dns
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Adding SASL authentication configuration
/run.sh: line 57: /etc/postfix/sasl_passwd: Permission denied
postmap: fatal: open /etc/postfix/sasl_passwd: No such file or directory
Setting configuration option mynetworks with value: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option maillog_file with value: /dev/stdout
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option myhostname with value: smtp.home.insanegenius.net
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option mydomain with value: insanegenius.net
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option mydestination with value: localhost
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option myorigin with value: $mydomain
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option relayhost with value: [smtp.gmail.com]:587
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_use_tls with value: yes
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_sasl_auth_enable with value: yes
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_sasl_password_maps with value: lmdb:/etc/postfix/sasl_passwd
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_sasl_security_options with value: noanonymous
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option always_add_missing_headers with value: no
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
Setting configuration option smtp_host_lookup with value: native,dns
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied
/run.sh: line 57: /etc/postfix/sasl_passwd: Permission denied
Adding SASL authentication configuration
postmap: fatal: open /etc/postfix/sasl_passwd: No such file or directory
Setting configuration option mynetworks with value: 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16
postconf: fatal: open /etc/postfix/main.cf.tmp: Permission denied

[juanluisbaptiste]

I'm trying to run all my docker images that don't need to be root as a non-root user. When I run this image as non-root, I get access denied errors.

AFAIK you need to run postfix's master process as root to be able to bind port 25 and access configuration files in /etc and spool files in /var/spool. I'm not aware of any other way to running postfix as non root user, if you are sure it can be done, please post the relevant documentation.

Sidenote; also wondering if mounting external volumes could also be used to persist delayed mail while upgrading the container, e.g. when watchtower applies an upgrade and mail is pending?

You can mount the spool directory like this:

 - "/localdir/spool:/var/spool/postfix" 

[ptr727]

Port mapping is not an issue, but /etc access may be.
I could mount /etc/postfix and /var/spool/postfix.
I'll try that and report back later.

[ptr727]

O, I tried and mounted:

    volumes:
      - "{{ appdata_dir }}/postfix-relay/config:/etc/postfix"
      - "{{ appdata_dir }}/postfix-relay/spool:/var/spool/postfix"

I get warnings about non-root access, e.g.:

Mar 17 14:47:30 smtp postfix/postfix-script[128]: warning: not owned by root: /var/spool/postfix/.
Mar 17 14:47:30 smtp postfix/postfix-script[130]: warning: group or other writable: /var/spool/postfix/.

And I have to copy the default /etc/postix config files to the /etc/postfix mount, and those could get out of sync with the container's version.

All in I decided it is not worth the trouble, will keep running as root.