Run containers as non-root user with Docker --user support

[brycelelbach]

Summary

This PR refactors the Docker container setup to run as a non-root user, improving security while maintaining full functionality. The implementation uses a unified entrypoint system with gosu for user switching and preserves passwordless sudo for operations that require root privileges.

Key Changes

Unified Entrypoint Architecture

• New brev/entrypoint.bash - Main dispatcher that handles user creation and delegates to service-specific scripts
• Service-specific entrypoints: entrypoint-base.bash, entrypoint-jupyter.bash, entrypoint-nsight.bash, entrypoint-shell.bash
• User-level scripts: entrypoint-base-user.bash, entrypoint-jupyter-user.bash (run as target user via gosu)

User Management

• Containers start as root, create a user dynamically based on ACH_UID/ACH_GID/ACH_USER environment variables (defaults to UID 1000)
• Uses gosu for secure user switching (avoids TTY and signal issues with sudo)
• Environment setup (Jupyter config, IPython startup scripts, Git safe directory) happens in the main entrypoint
• All users have passwordless sudo with environment passthrough for privileged operations

Development Environment

• brev/dev-common.bash replaces dev-mount.bash - Exports ACH_UID/ACH_GID/ACH_USER for Docker Compose
• Removed bindfs dependency entirely - no more FUSE mounts needed
• Simplified dev-start.bash, dev-stop.bash, dev-test.bash scripts

Docker Configuration

• All 5 tutorial Dockerfiles updated:
  • Install gosu and sudo
  • Enable passwordless sudo with environment/path passthrough
  • Remove static user creation (now dynamic in entrypoint)
• All docker-compose.yml files updated:
  • Services run as user: root (entrypoint handles user switching)
  • ACH_USER, ACH_UID, ACH_GID passed through environment

Nsight Streamer Integration

• entrypoint-nsight.bash runs as root, sets up environment, then delegates to nsight streamer's own entrypoint
• Fixed container restart issues by cleaning up symlinks/directories that nsight streamer creates unconditionally
• Copies required config files to dynamically created user's home directory

Profiling Tools

• Updated notebooks to invoke nsys and ncu with sudo for full profiling capabilities
• Sudo preserves environment and PATH (via sudoers configuration)

Bugfixes

• Fixed ownership of directories and log files created in entrypoint
• Pinned scikit-learn version in accelerated-python tutorial for cuML compatibility
• Updated docker-recipe.py for stdpar tutorial

Files Modified

New files:

• brev/entrypoint.bash - Main entrypoint dispatcher
• brev/entrypoint-base.bash, entrypoint-jupyter.bash, entrypoint-nsight.bash, entrypoint-shell.bash - Service entrypoints
• brev/entrypoint-base-user.bash, entrypoint-jupyter-user.bash - User-level scripts
• brev/dev-common.bash - Development environment helpers

Removed files:

• brev/dev-mount.bash - Replaced by dev-common.bash
• brev/nsight-start.bash - Replaced by entrypoint-nsight.bash
• brev/base-start.bash, brev/jupyter-start.bash - Renamed to entrypoint-*-user.bash

Updated files:

• All 5 tutorial Dockerfiles
• All 5 tutorial docker-compose.yml files
• brev/dev-start.bash, brev/dev-stop.bash, brev/dev-test.bash, brev/dev-shell.bash
• brev/jupyter-generate-plugin-settings.bash
• CONTRIBUTING.md - Removed bindfs references
• Multiple notebooks to use sudo for profiling tools

Benefits

• No bindfs dependency - simpler setup, no FUSE required
• Better security - containers run as non-root by default
• Consistent file ownership - files created match host user automatically
• Full profiling support - nsys/ncu work with full features via sudo
• Restartable containers - nsight container properly handles restarts
• Cross-platform - works on any system with Docker

[github-actions]

❌ Link Check Failed

Broken links were detected in this PR.

Please check the workflow run logs for details on which links are broken.

Common fixes:

1. Typo in URL - Check for spelling mistakes in the link
2. Outdated link - The page may have moved or been deleted
3. Relative path issue - Ensure relative links use the correct path
4. External site down - If the external site is temporarily down, you can add it to brev/.lycheeignore

To test links locally:

./brev/test-links.bash .

📚 Lychee documentation