Merge pull request #416 from linuxserver/nonroot

README.md

@@ -86,6 +86,15 @@ This image can be run with a read-only container filesystem. For details please
 * Runtime update of Plex (and thus Plexpass builds) is not supported.
 * Transcode directory must be mounted to a host path or tmpfs.
 
+## Non-Root Operation
+
+This image can be run with a non-root user. For details please [read the docs](https://docs.linuxserver.io/misc/non-root/).
+
+### Caveats
+
+* Runtime update of Plex (and thus Plexpass builds) is not supported.
+* Transcode directory must be mounted to a host path or tmpfs.
+
 ### Hardware Acceleration
 
 Many desktop applications need access to a GPU to function properly and even some Desktop Environments have compositor effects that will not function without a GPU. However this is not a hard requirement and all base images will function without a video device mounted into the container.
@@ -174,6 +183,7 @@ Containers are configured using parameters passed at runtime (such as those abov
 | `-v /tv` | Media goes here. Add as many as needed e.g. `/movies`, `/tv`, etc. |
 | `-v /movies` | Media goes here. Add as many as needed e.g. `/movies`, `/tv`, etc. |
 | `--read-only=true` | Run container with a read-only filesystem. Please [read the docs](https://docs.linuxserver.io/misc/read-only/). |
+| `--user=1000:1000` | Run container with a non-root user. Please [read the docs](https://docs.linuxserver.io/misc/non-root/). |
 
 ## Environment variables from files (Docker secrets)
 

readme-vars.yml

@@ -75,6 +75,10 @@ readonly_supported: true
 readonly_message: |
   * Runtime update of Plex (and thus Plexpass builds) is not supported.
   * Transcode directory must be mounted to a host path or tmpfs.
+nonroot_supported: true
+nonroot_message: |
+  * Runtime update of Plex (and thus Plexpass builds) is not supported.
+  * Transcode directory must be mounted to a host path or tmpfs.
 # init diagram
 init_diagram: |
   "plex:latest": {

root/etc/s6-overlay/s6-rc.d/init-plex-chown/run

@@ -6,16 +6,9 @@ mkdir -p /run/plex-temp
 # create folders
 if [[ ! -d "${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}" ]]; then
     mkdir -p "${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}"
+    if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
         lsiown -R abc:abc /config
-fi
+    fi
-
-# check Library permissions
-PUID=${PUID:-911}
-if [[ ! "$(stat -c %u /config/Library)" == "${PUID}" ]]; then
-    echo "Change in ownership detected, please be patient while we chown existing files"
-    echo "This could take some time"
-    lsiown -R abc:abc \
-        /config/Library
 fi
 
 # remove plex pid after unclean stop
@@ -23,9 +16,19 @@ if [[ -f "/config/Library/Application Support/Plex Media Server/plexmediaserver.
     rm -f "/config/Library/Application Support/Plex Media Server/plexmediaserver.pid"
 fi
 
-# set permissions on Plex Transcoder Temp Directory
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
-PLEX_MEDIA_SERVER_PREFERENCES="${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}/Plex Media Server/Preferences.xml"
+    # check Library permissions
-if [[ -f "${PLEX_MEDIA_SERVER_PREFERENCES}" ]]; then
+    PUID=${PUID:-911}
+    if [[ ! "$(stat -c %u /config/Library)" == "${PUID}" ]]; then
+        echo "Change in ownership detected, please be patient while we chown existing files"
+        echo "This could take some time"
+        lsiown -R abc:abc \
+            /config/Library
+    fi
+
+    # set permissions on Plex Transcoder Temp Directory
+    PLEX_MEDIA_SERVER_PREFERENCES="${PLEX_MEDIA_SERVER_APPLICATION_SUPPORT_DIR}/Plex Media Server/Preferences.xml"
+    if [[ -f "${PLEX_MEDIA_SERVER_PREFERENCES}" ]]; then
         TranscoderTempDirectory='\bTranscoderTempDirectory="([^"]+)"'
         while IFS= read -r line; do
             if [[ ${line} =~ ${TranscoderTempDirectory} ]] && [[ -d "${BASH_REMATCH[1]}" ]]; then
@@ -33,10 +36,11 @@ if [[ -f "${PLEX_MEDIA_SERVER_PREFERENCES}" ]]; then
                 lsiown -R abc:abc "${BASH_REMATCH[1]}"
             fi
         done <"${PLEX_MEDIA_SERVER_PREFERENCES}"
-fi
+    fi
 
-# permissions (non-recursive) on config root and folders
+    # permissions (non-recursive) on config root and folders
-lsiown abc:abc \
+    lsiown abc:abc \
         /run/plex-temp \
         /config \
         /config/*
+fi

root/etc/s6-overlay/s6-rc.d/init-plex-gid-video/run

@@ -1,9 +1,10 @@
 #!/usr/bin/with-contenv bash
 # shellcheck shell=bash
 
-FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null)
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    FILES=$(find /dev/dri /dev/dvb -type c -print 2>/dev/null)
 
-for i in ${FILES}; do
+    for i in ${FILES}; do
         VIDEO_GID=$(stat -c '%g' "${i}")
         VIDEO_UID=$(stat -c '%u' "${i}")
         # check if user matches device
@@ -32,4 +33,5 @@ for i in ${FILES}; do
                 chmod g+rw "${i}"
             fi
         fi
-done
+    done
+fi

root/etc/s6-overlay/s6-rc.d/svc-plex/run

@@ -6,6 +6,13 @@ PLEX_MEDIA_SERVER_INFO_MODEL=$(uname -m)
 export PLEX_MEDIA_SERVER_INFO_MODEL
 PLEX_MEDIA_SERVER_INFO_PLATFORM_VERSION=$(uname -r)
 export PLEX_MEDIA_SERVER_INFO_PLATFORM_VERSION
-exec \
+
+if [[ -z ${LSIO_NON_ROOT_USER} ]]; then
+    exec \
         s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 32400" \
             s6-setuidgid abc "/usr/lib/plexmediaserver/Plex Media Server"
+else
+    exec \
+        s6-notifyoncheck -d -n 300 -w 1000 -c "nc -z localhost 32400" \
+            "/usr/lib/plexmediaserver/Plex Media Server"
+fi