Skip to content

Commit b29a1b8

Browse files
thespadthespad
committed
Support nonroot operation
1 parent 5521df8 commit b29a1b8

File tree

5 files changed

+84
-57
lines changed

5 files changed

+84
-57
lines changed

‎README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -86,6 +86,15 @@ This image can be run with a read-only container filesystem. For details please
8686
* Runtime update of Plex (and thus Plexpass builds) is not supported.
8787
* Transcode directory must be mounted to a host path or tmpfs.
8888

89+
## Non-Root Operation
90+
91+
This image can be run with a non-root user. For details please [read the docs](https://docs.linuxserver.io/misc/non-root/).
92+
93+
### Caveats
94+
95+
* Runtime update of Plex (and thus Plexpass builds) is not supported.
96+
* Transcode directory must be mounted to a host path or tmpfs.
97+
8998
### Hardware Acceleration
9099

91100
Many desktop applications need access to a GPU to function properly and even some Desktop Environments have compositor effects that will not function without a GPU. However this is not a hard requirement and all base images will function without a video device mounted into the container.
@@ -174,6 +183,7 @@ Containers are configured using parameters passed at runtime (such as those abov
174183
| `-v /tv` | Media goes here. Add as many as needed e.g. `/movies`, `/tv`, etc. |
175184
| `-v /movies` | Media goes here. Add as many as needed e.g. `/movies`, `/tv`, etc. |
176185
| `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
186+
| `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |
177187

178188
## Environment variables from files (Docker secrets)
179189

‎readme-vars.yml‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,10 @@ readonly_supported: true
7575
readonly_message: |
7676
* Runtime update of Plex (and thus Plexpass builds) is not supported.
7777
* Transcode directory must be mounted to a host path or tmpfs.
78+
nonroot_supported: true
79+
nonroot_message: |
80+
* Runtime update of Plex (and thus Plexpass builds) is not supported.
81+
* Transcode directory must be mounted to a host path or tmpfs.
7882
# init diagram
7983
init_diagram: |
8084
"plex:latest": {

‎root/etc/s6-overlay/s6-rc.d/init-plex-chown/run‎

Lines changed: 30 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -6,37 +6,41 @@ mkdir -p /run/plex-temp
66
# create folders
77
if [[ ! -d "${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}" ]]; then
88
mkdir -p "${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}"
9-
lsiown -R abc:abc /config
10-
fi
11-
12-
# check Library permissions
13-
PUID=${PUID:-911}
14-
if [[ ! "$(stat -c %u /config/Library)" == "${PUID}" ]]; then
15-
echo "Change in ownership detected, please be patient while we chown existing files"
16-
echo "This could take some time"
17-
lsiown -R abc:abc \
18-
/config/Library
9+
if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
10+
lsiown -R abc:abc /config
11+
fi
1912
fi
2013

2114
# remove plex pid after unclean stop
2215
if [[ -f "/config/Library/Application Support/Plex Media Server/plexmediaserver.pid" ]]; then
2316
rm -f "/config/Library/Application Support/Plex Media Server/plexmediaserver.pid"
2417
fi
2518

26-
# set permissions on Plex Transcoder Temp Directory
27-
PLEX_MEDIA_SERVER_PREFERENCES="${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}/Plex Media Server/Preferences.xml"
28-
if [[ -f "${PLEX_MEDIA_SERVER_PREFERENCES}" ]]; then
29-
TranscoderTempDirectory='\bTranscoderTempDirectory="([^"]+)"'
30-
while IFS= read -r line; do
31-
if [[ ${line} =~ ${TranscoderTempDirectory} ]] && [[ -d "${BASH_REMATCH[1]}" ]]; then
32-
echo "Setting permissions on ${BASH_REMATCH[1]}"
33-
lsiown -R abc:abc "${BASH_REMATCH[1]}"
34-
fi
35-
done <"${PLEX_MEDIA_SERVER_PREFERENCES}"
36-
fi
19+
if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
20+
# check Library permissions
21+
PUID=${PUID:-911}
22+
if [[ ! "$(stat -c %u /config/Library)" == "${PUID}" ]]; then
23+
echo "Change in ownership detected, please be patient while we chown existing files"
24+
echo "This could take some time"
25+
lsiown -R abc:abc \
26+
/config/Library
27+
fi
3728

38-
# permissions (non-recursive) on config root and folders
39-
lsiown abc:abc \
40-
/run/plex-temp \
41-
/config \
42-
/config/*
29+
# set permissions on Plex Transcoder Temp Directory
30+
PLEX_MEDIA_SERVER_PREFERENCES="${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}/Plex Media Server/Preferences.xml"
31+
if [[ -f "${PLEX_MEDIA_SERVER_PREFERENCES}" ]]; then
32+
TranscoderTempDirectory='\bTranscoderTempDirectory="([^"]+)"'
33+
while IFS= read -r line; do
34+
if [[ ${line} =~ ${TranscoderTempDirectory} ]] && [[ -d "${BASH_REMATCH[1]}" ]]; then
35+
echo "Setting permissions on ${BASH_REMATCH[1]}"
36+
lsiown -R abc:abc "${BASH_REMATCH[1]}"
37+
fi
38+
done <"${PLEX_MEDIA_SERVER_PREFERENCES}"
39+
fi
40+
41+
# permissions (non-recursive) on config root and folders
42+
lsiown abc:abc \
43+
/run/plex-temp \
44+
/config \
45+
/config/*
46+
fi

‎root/etc/s6-overlay/s6-rc.d/init-plex-gid-video/run‎

Lines changed: 30 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,37 @@
11
#!/usr/bin/with-contenv bash
22
# shellcheck shell=bash
33

4-
FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null)
4+
if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
5+
FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null)
56

6-
for i in ${FILES}; do
7-
VIDEO_GID=$(stat -c '%g' "${i}")
8-
VIDEO_UID=$(stat -c '%u' "${i}")
9-
# check if user matches device
10-
if id -u abc | grep -qw "${VIDEO_UID}"; then
11-
echo "**** permissions for ${i} are good ****"
12-
else
13-
# check if group matches and that device has group rw
14-
if id -G abc | grep -qw "${VIDEO_GID}" && [[ $(stat -c '%A' "${i}" | cut -b 5,6) == "rw" ]]; then
7+
for i in ${FILES}; do
8+
VIDEO_GID=$(stat -c '%g' "${i}")
9+
VIDEO_UID=$(stat -c '%u' "${i}")
10+
# check if user matches device
11+
if id -u abc | grep -qw "${VIDEO_UID}"; then
1512
echo "**** permissions for ${i} are good ****"
16-
# check if device needs to be added to video group
17-
elif ! id -G abc | grep -qw "${VIDEO_GID}"; then
18-
# check if video group needs to be created
19-
VIDEO_NAME=$(getent group "${VIDEO_GID}" | awk -F: '{print $1}')
20-
if [[ -z "${VIDEO_NAME}" ]]; then
21-
VIDEO_NAME="video$(head /dev/urandom | tr -dc 'a-z0-9' | head -c4)"
22-
groupadd "${VIDEO_NAME}"
23-
groupmod -g "${VIDEO_GID}" "${VIDEO_NAME}"
24-
echo "**** creating video group ${VIDEO_NAME} with id ${VIDEO_GID} ****"
13+
else
14+
# check if group matches and that device has group rw
15+
if id -G abc | grep -qw "${VIDEO_GID}" && [[ $(stat -c '%A' "${i}" | cut -b 5,6) == "rw" ]]; then
16+
echo "**** permissions for ${i} are good ****"
17+
# check if device needs to be added to video group
18+
elif ! id -G abc | grep -qw "${VIDEO_GID}"; then
19+
# check if video group needs to be created
20+
VIDEO_NAME=$(getent group "${VIDEO_GID}" | awk -F: '{print $1}')
21+
if [[ -z "${VIDEO_NAME}" ]]; then
22+
VIDEO_NAME="video$(head /dev/urandom | tr -dc 'a-z0-9' | head -c4)"
23+
groupadd "${VIDEO_NAME}"
24+
groupmod -g "${VIDEO_GID}" "${VIDEO_NAME}"
25+
echo "**** creating video group ${VIDEO_NAME} with id ${VIDEO_GID} ****"
26+
fi
27+
echo "**** adding ${i} to video group ${VIDEO_NAME} with id ${VIDEO_GID} ****"
28+
usermod -a -G "${VIDEO_NAME}" abc
29+
fi
30+
# check if device has group rw
31+
if [[ $(stat -c '%A' "${i}" | cut -b 5,6) != "rw" ]]; then
32+
echo -e "**** The device ${i} does not have group read/write permissions, attempting to fix inside the container. ****"
33+
chmod g+rw "${i}"
2534
fi
26-
echo "**** adding ${i} to video group ${VIDEO_NAME} with id ${VIDEO_GID} ****"
27-
usermod -a -G "${VIDEO_NAME}" abc
28-
fi
29-
# check if device has group rw
30-
if [[ $(stat -c '%A' "${i}" | cut -b 5,6) != "rw" ]]; then
31-
echo -e "**** The device ${i} does not have group read/write permissions, attempting to fix inside the container. ****"
32-
chmod g+rw "${i}"
3335
fi
34-
fi
35-
done
36+
done
37+
fi

‎root/etc/s6-overlay/s6-rc.d/svc-plex/run‎

Lines changed: 10 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -6,6 +6,13 @@ PLEX_MEDIA_SERVER_INFO_MODEL=$(uname -m)
66
export PLEX_MEDIA_SERVER_INFO_MODEL
77
PLEX_MEDIA_SERVER_INFO_PLATFORM_VERSION=$(uname -r)
88
export PLEX_MEDIA_SERVER_INFO_PLATFORM_VERSION
9-
exec \
10-
s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 32400" \
11-
s6-setuidgid abc "/usr/lib/plexmediaserver/Plex Media Server"
9+
10+
if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
11+
exec \
12+
s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 32400" \
13+
s6-setuidgid abc "/usr/lib/plexmediaserver/Plex Media Server"
14+
else
15+
exec \
16+
s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 32400" \
17+
"/usr/lib/plexmediaserver/Plex Media Server"
18+
fi

0 commit comments

Comments
 (0)