以root身份启动Docker容器后Opam未初始化问题求助

操作流程与错误现象 #

1. 拉取镜像：

   docker pull brandojazz/iit-term-synthesis:test
   

2. 以root身份启动容器：

   docker run -u root -ti brandojazz/iit-term-synthesis:test_arm bash
   

3. 进入容器后执行opam switch，返回错误：

   (base) root@897a4007076f:/home/bot# opam switch
   [WARNING] Running as root is not recommended
   [ERROR] Opam has not been initialised, please run `opam init'
   

但根据Dockerfile配置，Opam应该已完成初始化。

对应的Dockerfile内容 #

FROM continuumio/miniconda3
# FROM --platform=linux/amd64 continuumio/miniconda3

MAINTAINER Brando Miranda "me@gmail.com"

RUN apt-get update \
  && apt-get install -y --no-install-recommends \
    ssh \
    git \
    m4 \
    libgmp-dev \
    opam \
    wget \
    ca-certificates \
    rsync \
    strace \
    gcc
#    rlwrap \
#    sudo

# https://github.com/giampaolo/psutil/pull/2103

RUN useradd -m bot
# format for chpasswd user_name:password
# RUN echo "bot:bot" | chpasswd
# RUN && adduser docker sudo

WORKDIR /home/bot
USER bot

ADD https://api.github.com/repos/IBM/pycoq/git/refs/heads/main version.json

# -- setup opam like VP's PyCoq
RUN opam init --disable-sandboxing
# compiler + '_' + coq_serapi + '.' + coq_serapi_pin
RUN opam switch create ocaml-variants.4.07.1+flambda_coq-serapi.8.11.0+0.11.1 ocaml-variants.4.07.1+flambda
RUN opam switch ocaml-variants.4.07.1+flambda_coq-serapi.8.11.0+0.11.1
RUN eval $(opam env)

RUN opam repo add coq-released https://coq.inria.fr/opam/released
# RUN opam pin add -y coq 8.11.0
# ['opam', 'repo', '--all-switches', 'add', '--set-default', 'coq-released', 'https://coq.inria.fr/opam/released']
RUN opam repo --all-switches add --set-default coq-released https://coq.inria.fr/opam/released
RUN opam update --all
RUN opam pin add -y coq 8.11.0

#RUN opam install -y --switch ocaml-variants.4.07.1+flambda_coq-serapi_coq-serapi_8.11.0+0.11.1 coq-serapi 8.11.0+0.11.1
RUN opam install -y coq-serapi

#RUN eval $(opam env)
#
## makes sure depedencies for pycoq are installed once already in the docker image
#RUN pip install https://github.com/ddelange/psutil/releases/download/release-5.9.1/psutil-5.9.1-cp36-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl
#ENV WANDB_API_KEY="SECRET"
#RUN pip install wandb --upgrade
#
#RUN pip install ultimate-utils
## RUN pip install pycoq  # do not uncomment on arm, unless serlib is removed from setup.py in the pypi pycoq version.
## RUN pip install ~/iit-term-synthesis  # likely won't work cuz we don't have iit or have pused it to pypi
#
## then make sure editable mode is done to be able to use changing pycoq from system
#RUN echo "pip install -e /home/bot/ultimate-utils" >> ~/.bashrc
#RUN echo "pip install -e /home/bot/pycoq" >> ~/.bashrc
#RUN echo "pip install -e /home/bot/iit-term-synthesis" >> ~/.bashrc
#RUN echo "pip install wandb --upgrade" >> ~/.bashrc
#
#RUN echo "eval $(opam env)" >> ~/.bashrc
## - set env variable for bash terminal prompt p1 to be nicely colored
#ENV force_color_prompt=yes
#
#RUN mkdir -p /home/bot/data/

# RUN pytest --pyargs pycoq
#CMD /bin/bash

原因分析 #

Dockerfile中所有Opam初始化操作都是在bot用户下执行的，Opam的配置文件、环境变量均存储在/home/bot/.opam目录下，且仅对bot用户可见。而启动容器时使用了-u root参数，切换到root用户后，系统会加载root的独立环境，无法识别bot用户下已配置好的Opam环境，因此提示未初始化。

解决方案 #

1. 默认用户启动容器：直接使用Dockerfile中指定的bot用户启动容器，无需加-u root参数：

   docker run -ti brandojazz/iit-term-synthesis:test_arm bash
   

   进入容器后直接执行opam switch即可正常显示已配置的环境。

2. root用户下切换到bot用户：如果必须以root身份进入容器，可执行以下命令切换到bot用户并加载其环境：

   su - bot
   opam switch
   

   使用su -会加载bot用户的登录shell环境，自动读取.bashrc中的配置。

3. root用户手动加载Opam环境：若不想切换用户，可在root下手动指定Opam的配置目录：

   export OPAMROOT=/home/bot/.opam
   opam switch
   

内容的提问来源于stack exchange，提问作者Charlie Parker