[rstudio] Changes for rootless

[phlg]

Hello,

This PR aims at changing some elements related to the rstudio image in order to allow it to run rootless. This is neither standard (see for instance this issue) nor comprehensively tested, but some basic testing was done and the service appears to run properly. The baseline for the implementation come from this other issue, and revolves around replacing the /init s6 entrypoint with a direct call to rserver.

The other meaningful changes are :

• Using chown to set onyxia (through the pre-existing ${USERNAME} variable) as the owner of several RStudio related directories. Without this, launching RStudio or authenticating on it triggers some permission denied errors.
• Manually setting the USER environment variable (to onyxia, in the same manner). This is a bit of a mystery ; when running as root, this variable is properly set (I suppose from this ?), but not anymore after implementing the other changes. This variable is required for authentication (see also : the pam-helper script from rocker).

As it is, there are some issues / choices I'd like a review of before considering a potential merge :

• Ideally, these changes could be implemented at runtime (to allow selecting between root/rootless at runtime, and not enforcing the rootless changes at build time), but I'm not sure it's possible as it would require the rights to chown/set environment variable at runtime (which we precisely want to avoid). I guess it's possible to take the problem in reverse (prepare the image for rootless at build time, and revert these changes back to stock RStudio at runtime in case we run as root), but I get the feeling this isn't clean and would like some external opinion.
• After settling for making the changes inside of the Dockerfile, I tried two alternatives : using Dockerfile directives (RUN, ENV) directly, and reusing the configure-rstudio.sh script. But with the latter, I could not find a way to set the USER environment variable that would make it visible to the actual rserver process (which implies broken authentication). Not sure this would end up as a better way though, so this point is kind of moot.
• For now, these changes overwrite the present rstudio service. I'm pretty sure this changed image would still work with a "run as root" security context if an operator overrides the entrypoint back to /init, but should I instead split the images (so we have a rstudio image, and then a separate rstudio-rootless image) ?

Thanks for your input !

[avouacr]

Hi @phlg, thank you very much for looking into this known issue and providing a basis for implementation. I'll have to look into it a bit and see how it behaves on the open instance. If it looks fine, I'm all for this to become the standard behavior, as it would then align RStudio on the other images of our stack that run with a non-root user -- a well-known best practice of Docker images after all. So IMO no need to look further into implementing it at runtime or building at as separate rootless image, let's focus on making sure that a rootless RStudio image works as intended in all contexts.