Synology NAS Set PUID and PGID as Variables

[newkind]

I'd like to kindly request a feature that would allow Synology NAS users to change the UID and GID as environment variables.

I know that there's a guide in WIKI on how to change the user to non-root but having this possiblity using environment variables would be awesome.

This is exactly the same feature request as it was made in the piHole : pi-hole/docker-pi-hole#328

Thank you!

[mprasil]

Can someone with synology submit a PR they've been able to verify that it works as expected? I can help making sure this does not break stuff on rest of the platforms.

[mtonnie]

What about a native package for synology, this would propably support more models than a docker solution.

[aledexter]

Can someone with synology submit a PR they've been able to verify that it works as expected? I can help making sure this does not break stuff on rest of the platforms.

What do you mean with PR?

[BlackDex]

Can someone with synology submit a PR they've been able to verify that it works as expected? I can help making sure this does not break stuff on rest of the platforms.

What do you mean with PR?

Since we do not have a Synology to test on, we can't debug and test these changes.
Also, since almost any and all systems work this way, we do not want to break stuff.

So if someone has a fix, they can request to merge/pull that change into the master branch.

[PrivatePuffin]

@newkind maybe file an issue with Synology instead?
Because they thosen to use a non-standard environment var (which is a bad idea) AND choose to use env-vars instead of docker to set permissions in the first place (also not in compliance with any decent docker standard).

It shouldn't be up to every container out there to fix the fuckups by synology imho.

[7opf]

The issue is that the UI from Synology's Docker package doesn't support the --user flag (in addition to some others like --cap-add). Current work around to get this project to run non-root would be to ssh into the NAS and use docker-compose .

# Create a non-privileged service user and add to group (Synology's distribution doesn't have useradd or adduser)
sudo synouser --add bitwardenrs Pa$$w0rd "Bitwarden_rs Docker" 0 "" ""
sudo synogroup --add bitwardenrs bitwardenrs

# Create a directory somewhere to hold your compose file and volume mount
mkdir -p /volume1/docker/bitwardenrs/data
cd /volume1/docker/bitwardenrs

# ensure the service user has access to data dir
sudo chown bitwardenrs:bitwardenrs data
sudo chmod 750 data

# create your docker-compose file
vi docker-compose.yml

Your compose file might look something like this

version: '3.3'
services:
  bitwardenrs:
    image: bitwardenrs/server:latest
    restart: always
    user: 'bitwardenrs:bitwardenrs'
    volumes:
      - '/volume1/docker/bitwardenrs/data/:/data'
    environment:
      ADMIN_TOKEN: <AdminToken> # (if admin UI is desired)
      WEBSOCKET_ENABLED: 'false' # I had to hack around with Synology's moustache templates to get websockets working behind reverse proxy, it's not possible with what Synology exposes through DSM (I'm happy to be proven overwise!). I don't recommend attempting this unless you know what you're doing.
    ports:
      - '8181:80'
    #  - '3012:3012' # normally for websockets
networks: 
  default:
    external:
      name: bridge # Synology docker sets up a network called bridge by default. If you don't specify this, compose will create a new network which also works, but just be aware that you may need to configure your firewall as appopriate.

When you are ready, run compose. You'll see the container will turn up in the UI as well

sudo docker-compose up -d

Disclaimer: I haven't actually tested this yet. Will probably try this week.

Some refs

https://docs.docker.com/compose/compose-file/compose-file-v3/#domainname-hostname-ipc-mac_address-privileged-read_only-shm_size-stdin_open-tty-user-working_dir

https://github.com/dani-garcia/bitwarden_rs/wiki/Using-Docker-Compose

[7opf]

What ended up working for me on Synology was this:

# get UID and GID of the non-root user on host
sudo synouser --get bitwardenrs
sudo synogroup --get bitwardenrs

version: '3.7'
services:
  bitwardenrs:
    image: bitwardenrs/server:latest
    restart: always
    user: 'UID:GID' # you have to use the IDs (see above), the names won't work as they won't exist inside the container
    volumes:
      - '/volume1/docker/bitwardenrs/data/:/data'
    environment:
      # ADMIN_TOKEN:
      # WEBSOCKET_ENABLED: 'false' # I had to hack around with Synology's moustache templates to get websockets working behind reverse proxy, it's not possible with what Synology exposes through DSM (I'm happy to be proven overwise!). I don't recommend attempting this unless you know what you're doing.
      LOG_FILE: /data/bitwarden.log
      ROCKET_PORT: '8080' # since non-root user is used, rocket cannot run on port 80 (default)
    ports:
      - '8181:8080'
    #  - '3012:3012' # normally for websockets

Docker didn't like re-using the pre-existing network synology sets up so you can let it create one automatically. I didn't need to configure anything special in the firewall for it to work contrary to my prev comment.

[DrDeath]

I can confirm, this is working on a synology NAS.

[...]
    user: 'UID:GID' # you have to use the IDs (see above), the names won't work as they won't exist inside the container
[...]
    ROCKET_PORT: '8080' # since non-root user is used, rocket cannot run on port 80 (default)
    ports:
      - '8181:8080'
[...]

Maybe this solution could be inserted into the wiki.

Edit: Already in the Wiki: https://github.com/dani-garcia/bitwarden_rs/wiki/Hardening-Guide

[waschinski]

I am using portainer on my Synology NAS and don't see any option to set user. So having ENV variables for UID/GID would still be helpful in my use case.

[MilesTEG1]

I use docker on a Synology DS920+, and I use PGID and PUID.
Here an extract of my docker-compose.yml (with Portainer, or docker-compose in SSH) :

---
version: "2.4"

services:
  vaultwarden:
    image: vaultwarden/server:latest    # https://github.com/dani-garcia/vaultwarden
                                        # https://github.com/dani-garcia/vaultwarden/wiki
    container_name: vaultwarden
    networks:
      - vaultwarden_network
    environment:
      # Utiliser la commande (en SSH) : id NOM_UTILISATEUR
      - PUID=1000
      - PGID=1000
      - TZ=Europe/Paris
  ...