Downloaded data are owned by root

[alyssadai]

The created output/ folder is owned by root and cannot be modified without sudo, which might create issues for users.

To get around this, we may want to consider updating our recommended docker run command (in the query tool?) to run as a non-root-user.

[surchs]

Might be fixed with the user ID fix from our docker compose recipes

[surchs]

Blocked until https://neurobagel.github.io/dev-docs/sections/Docker/#running-docker-container-as-non-root-user is reviewed and we decide on how to solve issue

[surchs]

Reviewed the docs, I think it still makes more sense to go with the user in the image. For one, that's what is recommended by OWASP and others (e.g. https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html#rule-2-set-a-user). Secondly, it's easier to do than setting the -u flag in the command. And thirdly we can still decide to use -u, but having the non-root user in the image still makes sense. It won't give the user the same kind of flexibility to define the user ID inside the container - in which case we'd have to explain the -u option.

[surchs]

Related to:

• Update code snippet for dataget query-tool#431