Non root docker

.gitignore

@@ -5,13 +5,10 @@ venv*
 .venv*
 *workspace
 
-# this is the root directory for generated opi files
-# and is created at runtime by IOCs using PVI
+# these files are generated at runtime by IOC containers
 opi/auto-generated/*
-!opi/auto-generated/README.md
-
 autosave/*
-!autosave/.placeholder
+runtime/*
 
 # these files are generated from templates
 # when sourcing environment.sh

compose.yaml

@@ -46,3 +46,6 @@ services:
       - EPICS_PVA_NAME_SERVERS
       - EPICS_CA_NAME_SERVERS
       - EPICS_CA_ADDR_LIST
+
+    # run with same ID as the user (for docker - for podman run as root)
+    user: ${UIDGID}

include/init.sh

@@ -15,4 +15,12 @@ cat $root/services/phoebus/config/settings.template |
   sed -e "s/5064/$EPICS_CA_SERVER_PORT/g" \
       -e "s/5065/$EPICS_CA_REPEATER_PORT/g" \
       -e "s/5075/$EPICS_PVA_SERVER_PORT/g" > \
-      $root/services/phoebus/config/settings.ini
+      $root/services/phoebus/config/settings.ini
+
+# this is a workaround for docker creating host mounts as root if they don't exist:
+# not required for podman but benign
+for ioc in bl01t-di-cam-01 bl01t-ea-test-01 bl01t-mo-sim-01; do
+  mkdir -p $root/autosave/$ioc
+  mkdir -p $root/runtime/$ioc
+  mkdir -p $root/opi/auto-generated/$ioc
+done

include/ioc.yml

@@ -5,6 +5,10 @@
 services:
   # linux IOCs that run in a container #########################################
   linux_ioc: &linux_ioc
+    depends_on:
+      init:
+        condition: service_completed_successfully
+
     labels:
       # a reference to which repository created this IOC
       ioc_group: bl01t
@@ -14,6 +18,9 @@ services:
       # should be (used by machine IOCs) this is for parity (but redundant).
       location: localhost
 
+    # run with same ID as the user (for docker - for podman run as root)
+    user: ${UIDGID}
+
     security_opt:
       - label=disable
 

services/bl01t-di-cam-01/compose.yml

@@ -22,8 +22,7 @@ services:
     volumes:
       - ../../opi/auto-generated/bl01t-di-cam-01:/epics/opi
       - ../../autosave/bl01t-di-cam-01:/autosave
-      # FOR DEVCONTAINERS: mount in the parent of the project
-      - ../../..:/workspaces
+      - ../../runtime/bl01t-di-cam-01:/epics/runtime
 
     configs:
       - source: bl01t-di-cam-01_config
@@ -37,6 +36,10 @@ services:
     <<: *bl01t-di-cam-01
     image: ghcr.io/epics-containers/ioc-adsimdetector-developer:2025.3.5
 
+    volumes:
+      # FOR DEVCONTAINERS: mount in the parent of the project
+      - ../../..:/workspaces
+
     profiles:
       - devcontainer
 

services/bl01t-ea-test-01/compose.yml

@@ -16,6 +16,9 @@ services:
       IOC_NAME: bl01t-ea-test-01
       IOC_PREFIX: BL01T-EA-TEST-01
 
+    volumes:
+      - ../../runtime/bl01t-ea-test-01:/epics/runtime
+
     configs:
       - source: bl01t-ea-test-01_config
         target: epics/ioc/config

services/bl01t-mo-sim-01/compose.yml

@@ -18,6 +18,7 @@ services:
     volumes:
       - ../../opi/auto-generated/bl01t-mo-sim-01:/epics/opi
       - ../../autosave/bl01t-mo-sim-01:/autosave
+      - ../../runtime/bl01t-mo-sim-01:/epics/runtime
 
     configs:
       - source: bl01t-mo-sim-01_config

services/gateway/compose.yml

@@ -15,6 +15,9 @@ services:
 
     image: ghcr.io/epics-containers/gateways-runtime:2024.12.3
 
+    # run with same ID as the user (for docker - for podman run as root)
+    user: ${UIDGID}
+
     security_opt:
       - label=disable
 

services/pvagw/compose.yml

@@ -12,6 +12,9 @@ services:
     depends_on:
       - init
 
+    # run with same ID as the user (for docker - for podman run as root)
+    user: ${UIDGID}
+
     security_opt:
       - label=disable