Adds support for running zuul-registry as a non-root user

Signed-off-by: Jack Morgan <jack@jento.io>
Change-Id: I89594affb04639b49b409a569036d6afac997251

inventory/service/group_vars/registry.yaml

@@ -1,3 +1,6 @@
+# Note: creating separate userid/groupid from the zuul service user
 registry_user: zuul
+registry_service_user_id: 10001
+registry_service_group_id: 10001
 iptables_extra_public_tcp_ports:
   - 5000

playbooks/roles/registry/tasks/main.yaml

@@ -1,34 +1,80 @@
-- name: Synchronize docker-compose directory
+- name: Create registry_service group
-  synchronize:
+  group:
-    src: registry-docker/
+    name: "registry"
-    dest: /etc/registry-docker/
+    gid: "{{ registry_service_group_id }}"
+    system: yes
+
+- name: Create registry_service user
+  user:
+    name: "registry"
+    group: "registry"
+    uid: "{{ registry_service_user_id }}"
+    home: "/var/registry"
+    system: yes
+
+- name: Make docker-compose dir
+  file:
+    state: directory
+    path: /etc/registry-docker
+    owner: root
+    group: root
+    mode: 0755
+
+- name: Write docker-compose.yaml
+  template:
+    src: docker-compose.yaml.j2
+    dest: /etc/registry-docker/docker-compose.yaml
+    owner: root
+    group: root
+    mode: 644
+
+- name: Ensure directory permission
+  file:
+    state: directory
+    path: /var/registry/
+    owner: registry
+    group: registry
+    mode: 0755
+
 - name: Ensure registry volume directories exists
   file:
     state: directory
     path: "/var/registry/{{ item }}"
+    owner: registry
+    group: registry
   loop:
     - certs
     - conf
     - etc
+
 - name: Write clouds.yaml
   template:
     src: clouds.yaml.j2
     dest: /var/registry/etc/clouds.yaml
+    owner: registry
+    group: registry
+
 - name: Write registry config
   template:
     src: registry.yaml.j2
     dest: /var/registry/conf/registry.yaml
+    owner: registry
+    group: registry
+
 - name: Run docker-compose pull
   shell:
     cmd: docker-compose pull
     chdir: /etc/registry-docker/
+
 - name: Run docker-compose up
   shell:
     cmd: docker-compose up -d
     chdir: /etc/registry-docker/
+
 - name: Run docker prune to cleanup unneeded images
   shell:
     cmd: docker image prune -f
+
 # Temporarily disable to aid debug of mysteriously absent blobs
 # -corvus 2019-10-09
 # - name: Install cron to garbage collect the registry daily

playbooks/roles/registry/templates/docker-compose.yaml.j2

@@ -5,8 +5,9 @@ version: '2'
 services:
   registry:
     restart: always
-    image: docker.io/zuul/zuul-registry
     network_mode: host
+    image: docker.io/zuul/zuul-registry
+    user: "{{ registry_service_user_id }}:{{ registry_service_group_id }}"
     volumes:
       - /var/registry/certs:/certs
       - /var/registry/conf:/conf