Skip to content

feat: Make Dockerfile compatible with OpenShift and non-root environments#611

Open
dotmobo wants to merge 1 commit intospeaches-ai:masterfrom
dotmobo:feature/openshift
Open

feat: Make Dockerfile compatible with OpenShift and non-root environments#611
dotmobo wants to merge 1 commit intospeaches-ai:masterfrom
dotmobo:feature/openshift

Conversation

@dotmobo
Copy link
Copy Markdown

@dotmobo dotmobo commented Feb 9, 2026

This pull request refactors the Dockerfile to ensure compatibility with security-constrained container platforms like OpenShift, which enforce a "run as non-root" policy with an arbitrary user ID.

The previous Dockerfile was not suitable for these environments because it relied on:

  1. The creation of a hardcoded ubuntu user (uid 1000).
  2. A WORKDIR located in the user's home directory (/home/ubuntu).

This approach fails when the container is launched with an arbitrary, non-root user, as that user lacks permissions to write to the home directory or other root-owned locations.

To address this, the Dockerfile has been modified as follows:

  • Removed User Creation: The USER instruction and useradd command have been removed. The container is now designed to be run by any user ID.
  • Standardized WORKDIR: The working directory is now set to a neutral /app location.
  • Permissions for Arbitrary Users: Added a RUN step using chgrp and chmod to adjust group ownership and permissions on the virtual environment's binaries (.venv/bin). This is the key
    change that allows an arbitrary user (belonging to the root group, GID 0) to execute the application.
  • Cleaned up Paths: All paths and environment variables (like PATH and uv cache directories) have been updated to use the /app directory, ensuring all application-related files are kept
    in one place.

These changes make our container more secure and portable, enabling seamless deployment on OpenShift and other locked-down environments without sacrificing functionality.

@dotmobo
Copy link
Copy Markdown
Author

dotmobo commented Feb 9, 2026

It works fine on OpenShift, you just have to specify the HF cache folder with an env var in the helm chart like

  env:
    HF_HOME: "/cache/huggingface"

And mount a volume like :

volumeMounts:
            - name: speaches-cache
              mountPath: /cache/huggingface

Tested with faster whisper small and piper

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant