Skip to content

Commit ac74fdb

Browse files
committed
docs: upgrades for privilege-less Docker images
1 parent f58cf83 commit ac74fdb

File tree

2 files changed

+133
-5
lines changed

2 files changed

+133
-5
lines changed

sources/platform/actors/development/actor_definition/docker.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ All Apify Docker images are pre-cached on Apify servers to speed up Actor builds
2626

2727
### Node.js base images
2828

29-
These images come with Node.js (versions `16`, `18`, `20`, or `22`) the [Apify SDK for JavaScript](/sdk/js), and [Crawlee](https://crawlee.dev/) preinstalled. The `latest` tag corresponds to the latest LTS version of Node.js.
29+
These images come with Node.js (versions `20`, `22`, or `24`) the [Apify SDK for JavaScript](/sdk/js), and [Crawlee](https://crawlee.dev/) preinstalled. The `latest` tag corresponds to the latest LTS version of Node.js.
3030

3131
| Image | Description |
3232
| ----- | ----------- |
@@ -41,7 +41,7 @@ See the [Docker image guide](/sdk/js/docs/guides/docker-images) for more details
4141

4242
### Python base images
4343

44-
These images come with Python (version `3.8`, `3.9`, `3.10`, `3.11`, or `3.12`) and the [Apify SDK for Python](/sdk/python) preinstalled. The `latest` tag corresponds to the latest Python 3 version supported by the Apify SDK.
44+
These images come with Python (version `3.9`, `3.10`, `3.11`, `3.12`, or `3.13`) and the [Apify SDK for Python](/sdk/python) preinstalled. The `latest` tag corresponds to the latest Python 3 version supported by the Apify SDK.
4545

4646
| Image | Description |
4747
| ----- | ----------- |
@@ -61,9 +61,9 @@ To use a custom `Dockerfile`, you can either:
6161
If no `Dockerfile` is provided, the system uses the following default:
6262

6363
```dockerfile
64-
FROM apify/actor-node:20
64+
FROM apify/actor-node:24
6565

66-
COPY package*.json ./
66+
COPY --chown=myuser:myuser package*.json ./
6767

6868
RUN npm --quiet set progress=false \
6969
&& npm install --only=prod --no-optional \
@@ -74,7 +74,7 @@ RUN npm --quiet set progress=false \
7474
&& echo "NPM version:" \
7575
&& npm --version
7676

77-
COPY . ./
77+
COPY --chown=myuser:myuser . ./
7878
```
7979

8080
For more information about `Dockerfile` syntax and commands, see the [Dockerfile reference](https://docs.docker.com/reference/dockerfile/).
Lines changed: 128 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,128 @@
1+
---
2+
title: Dockerfile user updates
3+
description: Learn what changes you need to do in your Actor Docker files with the new user changes
4+
slug: /actors/development/docker-user-changes
5+
---
6+
7+
**Learn what changes and issues you might encounter after some of our Docker images migrate to a privilege-less user**
8+
9+
---
10+
11+
:::danger A note about the warning
12+
13+
The warning in the base Docker images will be removed near the end of the year! Make sure you update your Docker files until then so you don't forget!
14+
15+
If you have issues or questions about it, feel free to open an issue on our [GitHub repository](https://github.com/apify/apify-actor-docker/issues/new)
16+
17+
:::
18+
19+
---
20+
21+
This page is mostly dedicated for the users of the following Docker images:
22+
23+
- `apify/actor-node`
24+
- `apify/actor-python`
25+
- `apify/actor-python-playwright`
26+
- `apify/actor-python-selenium`
27+
28+
### What's changed?
29+
30+
These images are moving from using the built-in **`root`** user and a usually random work directory (for example `/usr/src/app`) to consistent ones with our other Docker images.
31+
32+
Specifically, the user is now **`myuser`**, and the working directory is **`/home/myuser`**.
33+
34+
Now, you might ask yourself: why?. Our node Docker images that come with browsers do this in order to ensure the Actor runs in a more-secure environment, should there be any vulnerabilities in the dependencies.
35+
36+
We want to ensure all our images follow this pattern. As such, after this Pull Request on [GitHub](https://github.com/apify/apify-actor-docker/pull/188), that will become the default for all our Docker images.
37+
38+
### Common issues
39+
40+
#### Crawlee images automatically installing `git` in Python images
41+
42+
If you've built your Actor using [Crawlee](https://crawlee.dev/) templates, you might have the following line in your Dockerfile:
43+
44+
```dockerfile
45+
RUN apt update && apt install -yq git && rm -rf /var/lib/apt/lists/*
46+
```
47+
48+
You can safely remove this line, as the `git` package is now installed in the base image.
49+
50+
#### `uv` package manager fails to install dependencies
51+
52+
If you've built your Actor using [Crawlee](https://crawlee.dev/) templates, or you hand-rolled your own Dockerfile,
53+
you might have the following line in your Dockerfile:
54+
55+
```dockerfile
56+
ENV UV_PROJECT_ENVIRONMENT="/usr/local"
57+
```
58+
59+
As of the move to the new user, this variable will cause `uv` to throw an error due to permission errors. You can safely remove it!
60+
Alternatively, you can adjust it to point to the `/home/myuser` directory.
61+
62+
#### How do I copy my files while also `chown`ing them to the new user?
63+
64+
When using the `COPY` instruction to copy your files to the container, you should append the `--chown=myuser:myuser` flag to the command.
65+
66+
Here's a few common example:
67+
68+
```dockerfile
69+
COPY --chown=myuser:myuser requirements.txt ./
70+
71+
COPY --chown=myuser:myuser . ./
72+
```
73+
74+
:::warning
75+
76+
If your Dockerfile contains a `RUN` instruction similar to the following one, you should remove it:
77+
78+
```dockerfile
79+
RUN chown -R myuser:myuser /home/myuser
80+
```
81+
82+
Instead, add the `chown` flag to the `COPY` instruction:
83+
84+
```dockerfile
85+
COPY --chown=myuser:myuser . ./
86+
```
87+
88+
Running `chown` across multiple files will needlessly slow down the build process.
89+
90+
:::
91+
92+
#### The template I used is trying to add an `apify` user
93+
94+
If your Docker file has instructions similar to the following:
95+
96+
```dockerfile
97+
# Create and run as a non-root user.
98+
RUN adduser -h /home/apify -D apify && \
99+
chown -R apify:apify ./
100+
USER apify
101+
```
102+
103+
You should remove it, as the new user is now **`myuser`**. Don't forget to update your `COPY` instructions to use the `chown` flag with the `myuser` user.
104+
105+
```dockerfile
106+
COPY --chown=myuser:myuser . ./
107+
```
108+
109+
#### How do I install dependencies that require root access via `apt` / `apk`?
110+
111+
The good news is that the **`root`** user is still available in the Docker images. If you must run steps that require root access, here's an example of how you should do it:
112+
113+
```dockerfile
114+
FROM apify/actor-node:24
115+
116+
# Switch to root temporarily to install dependencies
117+
USER root
118+
119+
RUN apt update \
120+
&& apt install -y <dependencies here>
121+
122+
# Switch back to the non-root user
123+
USER myuser
124+
125+
# ...
126+
```
127+
128+
If your Actor *needs* to run as **`root`** for some reason, just add the `USER root` in your Dockerfile after the `FROM` instruction. But for a majority of Actors, this is not the case.

0 commit comments

Comments
 (0)