Is a pipe running in a Docker image without root user supported?

[Julien HENRY]

Hi,

We tried to change our pipe to use a base Docker image where the user is a regular user, not root.

As a result, the pipeline failed when trying to write to $BITBUCKET_PIPE_STORAGE_DIR:

tee: /opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes/sonarsource/sonarcloud-scan/sonarcloud-scan.log: Permission denied

So we had to revert to root.

Is this even possible to run a pipe with a non-root user? Or is it part of Bitbucket Pipes guidelines that Docker images should be run as root?

I am fine with the second option, but would it be possible to explicitly document it, as GitHub does for GitHub Actions, to stop users from challenging us for not following Docker best practices?

FYI I added some debug logs to my pipe, and here is the result of ls -ad $BITBUCKET_PIPE_STORAGE_DIR:

drwxr-xr-x 2 root root 4096 Oct 3 14:09 /opt/atlassian/pipelines/agent/build/.bitbucket/pipelines/generated/pipeline/pipes/sonarsource/sonarcloud-scan

You can see that only root can write in this folder.

[Igor Stoyanov]

Hi @Julien HENRY . Thanks for your question.

We will discuss this with Bitbucket Pipelines team  and notify you.

Regards, Igor

[Shlomo Heigh]

How is this still not fixed? Nothing should require containers to run in root in today's security climate.