Add user and group to all invocations of `docker run`

[mahesh-panchal]

Discussion from Slack thread: https://nfcore.slack.com/archives/C043FMKUNLB/p1743470447418089

When running docker containers, either within Nextflow or on the command-line, it would be good practice to run as the user, so outputs are not written out as root user.

docker run --rm -it -u $(id -u):$(id -g) <image>

and

    docker {
        docker.enabled       = true
        docker.runOptions    = '-u $(id -u):$(id -g)'   // <- run as your user. Not root user.
    }

A drop-down box marked as a note, or a callout would also be useful the first time the user runs docker in the lesson. This would explain that docker containers are by default run as the user they were built with (often root user), and therefore the outputs written by the software are also owned by that user. In order to run as the user running the container, one needs to supply the -u option with the argument above.

[mahesh-panchal]

Seems @maxulysse already made something with #558

[mahesh-panchal]

And @ewels brings up a good point. Who's the user in a .devcontainer?

[ewels]

It's variable and annoying I think, which is why we set it to root. Maybe something to do with one user building the base image and another running the environment? It certainly got messy. Running as root in codespaces fixed everything there.

I suspect when we have separate local / codespaces devcontainer configs this is something that we could have as variable between them.

[mahesh-panchal]

Did someone try this? https://stackoverflow.com/a/78621662
Setting the remoteUser.

[mahesh-panchal]

Do we need to use docker? Would Podman be an alternative?

[vdauwera]

I'd really like to avoid complicating things in the beginner examples. We don't show beginners best practices for everything, sometimes we simplify things and we tell them later there's a better way for when they're doing real work. I'm open to adding a box/comment to that effect if you'd like to suggest some wording, @mahesh-panchal

[mahesh-panchal]

Suggestion:

💡 A Note for Docker Users on File Permissions

By default, Docker containers run using the user they were built with, which is often the root user.

This means any output files the container creates will be owned by root on your computer, not by your own user account. This can lead to frustrating permission issues when you try to access or modify those files later.

To avoid this, we can explicitly tell Docker to run the container using your current host user and group ID. We do this by adding the -u $(id -u):$(id -g) flag.

• $(id -u) dynamically provides your user ID.
• $(id -g) dynamically provides your group ID.

You will see this used in our docker run commands and set in Nextflow configurations like this:

docker {
    runOptions = '-u $(id -u):$(id -g)'
}