Can't run EF in a docker container as non root

Question

I have the following docker file:

    FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
    WORKDIR /src
    COPY ["myapp.database/src/myapp.database.csproj", "myapp.database/"]
    COPY ["myapp.database/src/NuGet.config", "myapp.database/"]
    RUN dotnet restore "myapp.database/myapp.database.csproj"
    COPY myapp.database/src myapp.database
    WORKDIR /src/myapp.database
    RUN dotnet build "myapp.database.csproj" -c Release -o /app/build

    FROM build AS publish
    RUN dotnet publish "myapp.database.csproj" -c Release -o /app/publish

    FROM build AS final

    RUN groupadd -g 500 dotnetuser && \
        useradd -r -u 500 -g dotnetuser dotnetuser
        
    RUN dotnet tool install --global dotnet-ef --version 3.1.0
    ENV PATH="${PATH}:/root/.dotnet/tools"

    WORKDIR /app
    COPY --from=publish /app/publish .
    ENTRYPOINT ["dotnet", "myapp.database.dll"]

I create a user "dotnetuser" with uid as 500. I specify the following in my docker-compose:

version: '3.4'
services:
  postgres:
    image: postgres:12.1-alpine
    ports:
      - "5432:5432"
    environment:
      POSTGRES_USER: myapp
      POSTGRES_PASSWORD: myapp
      POSTGRES_DB: myapp
    volumes:
      - postgresvolume:/var/lib/postgresql/data
    networks:
      - dockercomposedatabase_default
  myapp.database:
    depends_on:
      - postgres
    user: "500"
    build:
      context: ..
      dockerfile: myapp.database/build/Dockerfile
    environment:
      DOTNET_CLI_HOME: "/tmp/DOTNET_CLI_HOME"
    networks:
      - dockercomposedatabase_default
volumes:
  postgresvolume:
   external: false
networks:
  dockercomposedatabase_default:
    external: true

However, I can only run EF commands from my container if I run the container as root.

If I run as dotnetuser, then I get the following error:

Could not execute because the specified command or file was not found.
Possible reasons for this include:
* You misspelled a built-in dotnet command.
* You intended to execute a .NET Core program, but dotnet-ef does not exist.
* You intended to run a global tool, but a dotnet-prefixed executable with this name could not be found on the PATH.

I've tried various ways to get the dotnetuser to run ef commands as non-root, but without any success :(

Even if I install the tools to the dotnetuser home path, I still get issues with permissions.

How can I run dotnet ef database update if I run the docker as non-root?

Answer 1

It turns out that what I wanted to do wasn't possible. That is because EF will try to build even if you ship the compiled binaries. On immutable images, you won't be able to execute the EF tools. https://github.com/dotnet/efcore/issues/13339

However, there is a workaround I found on this Blog mentioned on the github issue: https://mattmillican.com/blog/ef-core-migrations-on-linux

Of course in my case, things were a little different. I changed my docker and created a migration.sh script.

FROM mcr.microsoft.com/dotnet/core/sdk:3.1-buster AS build
WORKDIR /src
COPY ["myapp.database/src/myapp.database.csproj", "myapp.database/"]
COPY ["myapp.database/src/NuGet.config", "myapp.database/"]
COPY ["myapp.database/src/migration.sh", "myapp.database/"]
RUN dotnet restore "myapp.database/myapp.database.csproj"
COPY myapp.database/src myapp.database
WORKDIR /src/myapp.database
RUN dotnet build "myapp.database.csproj" -c Release -o /app/build

FROM build AS publish
RUN dotnet publish "myapp.database.csproj" -c Release -o /app/publish

RUN chmod +x /app/publish/migration.sh

FROM build AS final

RUN groupadd -g 500 dotnetuser && \
    useradd -r -u 500 -g dotnetuser dotnetuser

RUN mkdir /tools

RUN dotnet tool install  dotnet-ef --tool-path /tools --version 3.1.0
ENV PATH="${PATH}:/tools:/app"

WORKDIR /app
COPY --chown=dotnetuser:dotnetuser --from=publish /app/publish .

RUN rm -r /src

RUN chown dotnetuser:dotnetuser -R /tools
RUN chown dotnetuser:dotnetuser -R /app

USER dotnetuser
ENTRYPOINT ["migration.sh"]

I used my migration.sh script to execute the migration and then execute my myapp.database.dll to run my fixtures.

#!/bin/sh
# MIGRATION_NAME is an environmental variable for specifying the which migration to migrate to. It will allow you to migrate forward and back. Don't set the environmental value if you want to migrate to the latest migration.
# This path is important but may change between upgrades!!!
EF_DLL_PATH=/tools/.store/dotnet-ef/3.1.0/dotnet-ef/3.1.0/tools/netcoreapp3.1/any/tools/netcoreapp2.0/any/ef.dll

# standard compiled files for dotnet
DEPS_FILE=myapp.database.deps.json
RUNTIME_CONFIG=myapp.database.runtimeconfig.json

# assembly name
PROJECT_NAME=myapp.database
cd /app

echo "Executing the migration script..."
dotnet exec --depsfile ${DEPS_FILE} --runtimeconfig ${RUNTIME_CONFIG} "${EF_DLL_PATH}" database update ${MIGRATION_NAME} --context MyAppDbContext --assembly ${PROJECT_NAME}.dll --startup-assembly ${PROJECT_NAME}.dll --root-namespace ${PROJECT_NAME} || {
    echo "Could not execute the migration!" 
    exit 1
}

echo "migration to ${MIGRATION} complete!"

echo "Run the fixtures..."
dotnet myapp.database.dll
echo "Fixtures applied!"

Hope this can helps someone.