title: Writing to Docker Filesystem as non-root, non-privileged user
body: <p>I have a node/docker app that runs some scripts, and downloads a file to the docker fs, which is then sent to an FTP server. The file is saved to the filesystem in a folder that resides in the same directory (app/src) as the node scripts, allowing easy access for the scripts to then ftp the file. Currently, the scripts are only able to download the file when the image is run as root user, with the --privileged flag. I want to production-ize this and deploy it (ideally on Heroku). Heroku does not allow images to be run as root afaik.</p>
  <p>Changing the user to non-root causes the file to not be downloaded, though the container is built perfectly fine, and the image runs with no errors thrown. Seems to be a permissions issue.</p>
  <p>Is there a way I can modify this so that I can run this as non-root user and still get the file into the filesystem? The scripts run a headless chrome browser that crawls a website and clicks a button to download an xls file. ( I have the non-privileged user commented out and root user uncommented here, just so I can switch back and forth when testing)</p>
  <p>Dockerfile</p>
  <pre><code>FROM node:latest
  
  # update and add all the steps for running with xvfb
  RUN apt-get update &amp;&amp;\
  apt-get install -yq gconf-service libasound2 libatk1.0-0 libc6 libcairo2 libcups2 libdbus-1-3 \
  libexpat1 libfontconfig1 libgcc1 libgconf-2-4 libgdk-pixbuf2.0-0 libglib2.0-0 libgtk-3-0 libnspr4 \
  libpango-1.0-0 libpangocairo-1.0-0 libstdc++6 libx11-6 libx11-xcb1 libxcb1 libxcomposite1 \
  libxcursor1 libxdamage1 libxext6 libxfixes3 libxi6 libxrandr2 libxrender1 libxss1 libxtst6 \
  ca-certificates fonts-liberation libappindicator1 libnss3 lsb-release xdg-utils wget \
  xvfb x11vnc x11-xkb-utils xfonts-100dpi xfonts-75dpi xfonts-scalable xfonts-cyrillic x11-apps \
  &amp;&amp; apt-get install -y wget gnupg \
  &amp;&amp; wget -q -O - https://dl-ssl.google.com/linux/linux_signing_key.pub | apt-key add - \
  &amp;&amp; sh -c 'echo &quot;deb [arch=amd64] http://dl.google.com/linux/chrome/deb/ stable main&quot; &gt;&gt; /etc/apt/sources.list.d/google.list' \
  &amp;&amp; apt-get update \
  &amp;&amp; apt-get install -y google-chrome-stable fonts-ipafont-gothic fonts-wqy-zenhei fonts-thai-tlwg fonts-kacst fonts-freefont-ttf libxss1 \
    --no-install-recommends \
  &amp;&amp; rm -rf /var/lib/apt/lists/*
  
  #remove zombie images
  ADD https://github.com/Yelp/dumb-init/releases/download/v1.2.2/dumb-init_1.2.2_x86_64 /usr/local/bin/dumb-init
  RUN chmod +x /usr/local/bin/dumb-init
  ENTRYPOINT [&quot;dumb-init&quot;, &quot;--&quot;]
  
  # add the required dependencies
  WORKDIR /app
  
  # COPY node_modules /app/node_modules
  
  RUN npm install puppeteer \
  # Add user so we don't need --no-sandbox.
      # same layer as npm install to keep re-chowned files from using up several hundred MBs more space
      &amp;&amp; groupadd -r pptruser &amp;&amp; useradd -r -g pptruser -G audio,video pptruser \
      &amp;&amp; mkdir -p /home/pptruser/Downloads \
      &amp;&amp; chown -R pptruser:pptruser /home/pptruser \
      &amp;&amp; npm install express \
      &amp;&amp; npm install basic-ftp 
      # &amp;&amp; chown -R pptruser:pptruser /node_modules
  EXPOSE 3000
  # Run everything after as non-privileged user.
  # USER pptruser
  USER root
  # Finally copy the build application
  COPY . .
  
  # make sure we can run without a UI
  ENV DISPLAY :99
  
  CMD Xvfb :99 -screen 0 1024x768x16 -nolisten unix &amp; node server.js
  </code></pre>
  <p>Here are permissions for /app</p>
  <pre><code>root@d5c51850b0b7:/app# ls -al
  
  total 92
  drwxr-xr-x   1 root root  4096 Dec  8 17:24 .
  drwxr-xr-x   1 root root  4096 Dec  9 17:05 ..
  -rw-r--r--   1 root root  6148 Dec  7 18:00 .DS_Store
  -rw-r--r--   1 root root    41 Dec  7 17:26 .dockerignore
  -rw-r--r--   1 root root    46 Dec  7 18:53 .env
  drwxr-xr-x   7 root root  4096 Dec  7 18:02 .git
  -rw-r--r--   1 root root  1610 Dec  7 18:01 .gitignore
  -rw-r--r--   1 root root  2120 Dec  8 17:24 Dockerfile
  -rw-r--r--   1 root root   950 Dec  7 21:50 Readme.md
  -rw-r--r--   1 root root   140 Dec  7 21:46 docker-compose.yml
  drwxr-xr-x 102 root root  4096 Dec  4 17:10 node_modules
  -rw-r--r--   1 root root 32485 Dec  7 19:36 package-lock.json
  -rw-r--r--   1 root root   307 Dec  7 19:36 package.json
  -rw-r--r--   1 root root   262 Dec  8 17:21 server.js
  drwxr-xr-x   2 root root  4096 Dec  7 17:26 src
  </code></pre>