[Buildroot] [PATCH] support/dockerfile: add directives to run as non-root

[Yann E. MORIN <yann.morin.1998@free.fr>]

Cam, All,

On 2018-02-05 14:52 +1100, Cam Hutchison spake thusly:
> On 4 February 2018 at 21:04, Yann E. MORIN <yann.morin.1998@free.fr> wrote:
[--SNIP--]
> >> I don't know much about Docker, but I was of the understanding that each
> >> run statement creates a new layer and the number of layers should be
> >> minimized, which is why you normally see stuff like:
[--SNIP--]
> Minimizing the number of layers for simple layers like the "RUN useradd"
> and "RUN chown" really doesn't save very much.
> 
> Where the big win comes in (and is not mentioned in the official
> documentation) is when you keep the "install && build && clean" commands
> in a single RUN command. This matters because if you split it up over
> multiple layers, the earlier layers still contain all the stuff the
> later layers try to clean. The end result is a fat image that contains
> the stuff you wanted to remove in a lower layer, with whiteout entries
> in a higher layer, so it only looks like the files have been removed.
> 
> Your patch set does the right thing WRT the debian install/clean, so all
> good, but I thought I'd mention this because it did not come up in any
> discussions here or in the linked docs.

OK, so we *do* have a Docker expert, now! ;-)

Thank you for your explanations, that was very instructive. I gues
that's because aufs is used underneath, or something like that?

I would have expected that, instead of implicit, a layer would have been
explicit, like with a COMMIT keyword or something like that...

Anyway, it all makes sense in hindsight, indeed. Thanks!

Regards,
Yann E. MORIN.

-- 
.-----------------.--------------------.------------------.--------------------.
|  Yann E. MORIN  | Real-Time Embedded | /"\ ASCII RIBBON | Erics' conspiracy: |
| +33 662 376 056 | Software  Designer | \ / CAMPAIGN     |  ___               |
| +33 223 225 172 `------------.-------:  X  AGAINST      |  \e/  There is no  |
| http://ymorin.is-a-geek.org/ | _/*\_ | / \ HTML MAIL    |   v   conspiracy.  |
'------------------------------^-------^------------------^--------------------'