Linux部分

在Linux中以root用户身份运行cronjobs很容易.

这可以通过在docker容器中创建一个用户,该用户具有与主机中相同的UID,并将crontab文件复制为/ var / spool / cron / crontabs / user_name.

来自man crontab

crontab is the program used to install,deinstall or list the
tables used to drive the cron(8) daemon in Vixie Cron. Each user can
have their own crontab,and though these are files in
/var/spool/cron/crontabs,they are not intended to be edited directly.

由于Linux通过User Id识别用户,因此在docker内部,UID将绑定到新创建的用户,而在主机中,UID将与主机用户绑定.

因此,您没有任何权限问题,因为这些文件归host_user所有.现在您可以理解为什么我提到使用与主机中相同的UID创建用户.

Docker部分

Docker认为所有目录(或层)都是UNION FILE SYSTEM.无论何时构建图像,每条指令都会创建一个图层,并且该图层将标记为只读.这就是Docker容器不会保留数据的原因.因此,您必须明确告诉docker某些目录需要使用VOLUME关键字来保存数据.

您可以在不明确提及卷的情况下运行容器.如果这样做,docker守护程序会将它们视为UFS并重置权限.
为了保留对包含所有权的文件/目录的更改.相应的文件应在Dockerfile中声明为Volume.

从UNION FILE SYSTEM起

Indeed,when a container has booted,it is moved into memory,and the boot filesystem is unmounted to free up the RAM used by the initrd disk image. So far this looks pretty much like a typical Linux virtualization stack. Indeed,Docker next layers a root filesystem,rootfs,on top of the boot filesystem. This rootfs can be one or more operating systems (e.g.,a Debian or Ubuntu filesystem).
Docker calls each of these filesystems images. Images can be layered on top of one another. The image below is called the parent image and you can traverse each layer until you reach the bottom of the image stack where the final image is called the base image. Finally,when a container is launched from an image,Docker mounts a read-write filesystem on top of any layers below. This is where whatever processes we want our Docker container to run will execute. When Docker first starts a container,the initial read-write layer is empty. As changes occur,they are applied to this layer; for example,if you want to change a file,then that file will be copied from the read-only layer below into the read-write layer. The read-only version of the file will still exist but is now hidden underneath the copy.

例：

我们假设我们有一个名为host_user的用户. host_user的UID是1000.现在我们将在Docker容器中创建一个名为docker_user的用户.因此,我将UID指定为1000.现在Docker容器中docker_user拥有的任何文件也归host_user所有,如果host_user可以从主机访问这些文件(即通过卷).

现在,您可以与其他人共享绑定目录,而不会出现任何权限问题.您甚至可以在相应的目录上授予777权限,允许其他人编辑数据.否则,您可以保留755权限,允许其他人复制,但只有所有者才能编辑数据.

我已声明该目录将更改保留为卷.这保留了所有更改.小心,因为一旦您将目录声明为卷,那么在构建时将对该目录进行进一步更改将被忽略,因为这些更改将位于不同的层中.因此,在目录中进行所有更改,然后将其声明为卷.

这是Docker文件.

FROM alpine:latest
ARG ID=1000 
#UID as arg so we can also pass custom user_id
ARG CRON_USER=docker_user
#same goes for username

COPY crontab /var/spool/cron/crontabs/$CRON_USER
RUN adduser -g "Custom Cron User" -DH -u $ID $CRON_USER && \
    chmod 0600 /var/spool/cron/crontabs/$CRON_USER && \
    mkdir /temp && \
    chown -R $ID:$ID /temp && \
    chmod 777 /temp

VOLUME /temp
#Specify the dir to be preserved as Volume else docker considers it as Union File System

ENTRYPOINT ["crond","-f","-l","2"]

这是crontab

* * * * * /usr/bin/whoami >> /temp/cron.log

构建图像

docker build . -t test

创建新卷

docker volume create --name myTestVolume

运行数据卷

docker run --rm --name test -d -v myTestVolume:/usr/local/src/myscript/result test:latest

Whenever you mount myTestVolume to other container you can see the
data under /usr/local/src/myscript/result is owned by UID 1000
if no user exist with that UID in that container or the username of
corresponding UID.

使用Bind音量运行

docker run --rm --name test - -dv $PWD:/usr/local/src/myscript/result test:latest

执行ls -al / home / host_user / temp时,您将看到名为cron.log的文件已创建,并由** host_user **拥有.

执行ls -al / temp时,docker容器中的docker_user将拥有相同的内容. cron.log的内容将是docker_user.

所以,你的有效Dockerfile应该是

FROM artemklevtsov/r-alpine:latest as baseImage

ARG ID=1000 

ARG CRON_USER=docker_user

RUN adduser -g "Custom Cron User" -DH -u $ID $CRON_USER && \
    chmod 0600 /var/spool/cron/crontabs/$CRON_USER && \
    echo http://nl.alpinelinux.org/alpine/edge/testing >> /etc/apk/repositories && \
    apk --no-cache add busyBox-suid curl && \
    mkdir -p /usr/local/src/myscript/result && \
    chown -R $ID:$ID /usr/local/src/myscript/result && \
    chmod 777 /usr/local/src/myscript/result

COPY crontab /var/spool/cron/crontabs/$CRON_USER

COPY . /usr/local/src/myscript/

VOLUME /usr/local/src/myscript/result
#This preserves chown and chmod changes.

WORKDIR /usr/local/src/myscript/

ENTRYPOINT ["crond","2"] 

现在,无论何时将数据/绑定卷附加到/usr/local / src / myscript / result,它都将由具有UID 1000的用户拥有,并且在所有容器中都是持久的,无论哪个容器安装了相同的卷,其相应的用户为1000作为文件所有者.

请注意：我已授予777权限,以便与每个人共享.您可以根据自己的意愿跳过Dockerfle中的该步骤.

参考文献：

> Crontab manual.
> User identiier – Wiki
> User ID Definition.
> About storage drivers.
> UNION FILE SYSTEM.