Dev Container should run as non-root user

[mnuman]

Bug description

The current setup runs the devcontainer as the root user, causing the jupyter server to fail from starting up. A work-around could be to start the jupyter server in the container with the --allow-root arguments, e.g.
uv run jupyter lab --allow-root, but I think the consensus is that it preferable to run docker containers as non-root user whenever possible.
The diagnostics script does not seem to be working correctly, instead it returns an "Illegal Instruction" message ... (see below)

What operating system are you using?

macOS

Where do you run your code?

Local (laptop, desktop)

Environment

source /workspaces/LLMs-from-scratch/.venv/bin/activate
root@86a19c43e05f:/workspaces/LLMs-from-scratch# source /workspaces/LLMs-from-scratch/.venv/bin/activate
(llms-from-scratch) root@86a19c43e05f:/workspaces/LLMs-from-scratch# curl --ssl-no-revoke -O https://raw.github.com/rasbt/LLMs-from-scratch/main/setup/02_installing-python-libraries/python_environment_check.py  \
-O https://raw.github.com/rasbt/LLMs-from-scratch/main/requirements.txt

python python_environment_check.py
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  5079  100  5079    0     0  17797      0 --:--:-- --:--:-- --:--:-- 18010
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   457  100   457    0     0   3139      0 --:--:-- --:--:-- --:--:--  3173
[OK] Your Python version is 3.11.10
Illegal instruction
(llms-from-scratch) root@86a19c43e05f:/workspaces/LLMs-from-scratch#

[rasbt]

Thanks for reporting. I must admit I am not a Docker user 😅.

I wonder if you have the same issues on Windows, @d-kleine ? I remember you are using VSCode so maybe you haven't bumped into that yet?

[d-kleine]

Yeah, I confirm this issue when trying to start Jupyter Lab with uv run jupyter lab from the terminal. It would be possible to set up the container with a non-root user, but will be a bit tricky to get everything installed and working.

Some thoughts on this issue:

• I have used the Docker container only inside VS Code with the Jupyter extension to open and view notebooks. So, in this case, Jupyter Lab is not needed then.
• Also, the container is an isolated environment.
• I guess that most users don't use/need the container to run the code. MacOS and Linux users should be fine anyways, and Windows users can switch to WSL in case they need a Linux-based OS (WSL uses less resources than the Docker container on Windows), for instance for installing triton for model.compile().

[mnuman]

Well, I actually wanted to run the Jupyter Server in the container to prevent contamination of my laptop. This would also allow me to run snippets in Python, e.g. for the supporting code and prerequisites, or just scratches when experimenting with the exact same set of dependencies as the Jupyter notebooks are running.
And yes, in theory the container is an isolated environment - until it is not. It is also about creating awareness that reducing the attack surface by running containers as non-root users is a good way to improve security.

[VoonaSriraj]

1.Configure the devcontainer to run as a non-root user by default.

2.Investigate the cause of the “Illegal instruction” in python_environment_check.py, possibly related to incompatible CPU instructions or missing dependencies in the devcontainer.

3.Add error handling or logging in the diagnostics script to help identify where the failure occurs.

[rasbt]

So, what would be your recommended actions here @d-kleine @mnuman to keep this docker container useful? (Sorry, I am personally not a docker user and have basically almost zero experience with this.)

I get the attack surface issue. But then, given that ~95% of the users here don't use it and are fine to run Python code in their main env or a venv, for this project, the container env is mainly about getting things set up on Windows.

Perhaps, the best option here is to maybe explain this? I.e., that we use --allow-root to easier install the required packages, jupyter etc, but in general, for unknown code, --allow-root is not a recommended practice?

[mnuman]

Well, if unexperienced with Docker I'd go for the easier option and explain, especially if this setup is just targeted to Windows users running locally.

[d-kleine]

Well, if unexperienced with Docker I'd go for the easier option and explain, especially if this setup is just targeted to Windows users running locally.

Yeah, I agree adding a notification/warning that the container runs as the root user should be added. When trying to run uv run jupyter lab, it will show following error:

Running as root is not recommended. Use --allow-root to bypass.

So, to bypass this, one would need to run the command with the --allow-root flag:

uv run jupyter lab --allow-root

Everything else (VS Code with Jupyter extension, isolated container, local usage only) has been mentioned above.

[rasbt]

Sounds good. I added a warning field via #833