From 9e06d13c8fb14c8e71155f7f1c5b82354622cee5 Mon Sep 17 00:00:00 2001 From: Masaya Kataoka Date: Wed, 15 Jul 2026 18:10:53 +0900 Subject: [PATCH] Run CARLA physics container as non-root user CarlaUE4 previously ran as root, which is unnecessary and violates the principle of least privilege. Create a dedicated system user "carla", give it ownership of the CARLA install tree and workdir, set HOME so xdg-user-dirs writes land in a writable location, and drop to that user before ENTRYPOINT. CARLA_UID / CARLA_GID build args let callers align the in-container UID with a host user when bind-mounting. Co-Authored-By: Claude Opus 4.7 (1M context) --- docker/carla/physics.Dockerfile | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/docker/carla/physics.Dockerfile b/docker/carla/physics.Dockerfile index 154a8776..edfe2ff0 100644 --- a/docker/carla/physics.Dockerfile +++ b/docker/carla/physics.Dockerfile @@ -157,6 +157,20 @@ RUN chmod +x /opt/entrypoint.sh RUN /opt/alpasim-physics/bin/python -c \ "import alpasim_physics, alpasim_grpc, alpasim_utils, carla_physics_server, numpy, warp" +# Run CARLA as a non-root user. CarlaUE4 writes into $CARLA_ROOT/CarlaUE4/Saved +# and reads xdg-user-dirs from $HOME, so we grant the user a writable home +# and ownership of the CARLA install tree. +ARG CARLA_UID=1000 +ARG CARLA_GID=1000 +RUN groupadd --system --gid ${CARLA_GID} carla \ + && useradd --system --uid ${CARLA_UID} --gid ${CARLA_GID} \ + --home-dir /home/carla --create-home --shell /usr/sbin/nologin carla \ + && mkdir -p /work \ + && chown -R carla:carla /opt/carla /work /home/carla + +USER carla:carla +ENV HOME=/home/carla + WORKDIR /work ENTRYPOINT ["/opt/entrypoint.sh"] CMD []