Description
Current behavior
- Lambda functions are executed as login user
root
in the new lambda provider (PROVIDER_OVERRIDE_LAMBDA=v2
). - Lambda functions are always executed as the same user and provided runtimes cannot change the user.
Expected behavior
- In AWS, lambda functions are executed as login user
sbx_user1051
- In AWS, provided runtimes (e.g., Bref project) can somehow change the login user (e.g.,
nobody
).
Motivation
Certain provided runtimes fail if they are not executed as a specific user (see PHP/Bref example below; The Bref layer includes a php-fpm.conf with a user nobody).
Original post by @shadowhand
I was linked to this PR from this Slack thread, and I wanted to drop a quick note about user settings. From what I have gathered, primarily from the Bref project, AWS Lambda executes code with
nobody:nobody
user/group.
This does not seem to be the case with Localstack Lambda, because when I try to execute my functions (with the PHP-FPM layer from Bref) they fail saying that "no user is defined". The error happens in the PHP-FPM layer, but the exact same layer has no issues in AWS proper. After discussing this with the Bref community, it seems this error will only happen when the Lambda environment executes as someone other than
nobody
.
If nothing else, it would be helpful to have
LAMBDA_DOCKER_FLAGS
support the--user
flag, which it currently does not.
Originally posted by @shadowhand in #6724 (comment)