This message was deleted.

So just after I wrote this I worked it out but ill leave it here as a breadcrumb for others. So the way to resolve it is to do the AFTER: part, but at the end of your Dockerfile, switch back to the atlantis user. This might cause other issues in your plays, however this was resolved by changing the user in the tasks. For example, we have an aws config that needs its permissions changing:

BEFORE:
- name: Make AWS conf readable by Atlantis
  community.docker.docker_container_exec:
    container: atlantis
    command: /bin/bash -c "chown atlantis:atlantis /home/atlantis/.aws/"

Becomes:

AFTER:
- name: Make AWS conf readable by Atlantis
  community.docker.docker_container_exec:
    user: root
    container: atlantis
    command: /bin/bash -c "chown atlantis:atlantis /home/atlantis/.aws/"

This is a great call out. It probably needs to be documented as part of the release notes. Could you comment this in the above pr for now so it's linkable?

Yes I can. I will sort it shortly!

Had the same issue this morning and adding

USER root

solved my issue. I will add the

USER atlantis

at the end as well to avoid any future issues. Thanks for sharing the solution

cc @Dylan Page @PePe Amengual can we add the above to the release notes? I think many might hit this issue

yes go for it

Maybe in custom workflows https://www.runatlantis.io/docs/custom-workflows.html

Ah that's it!

We can do a patch release and note it after we PR the new docs

how this sounds?

Since version `0.26.0` the atlantis image now uses the `atlantis` user to run atlantis instead of the root user. Previous container definitions and script might need to be adjusted to use the `atlantis` user instead of `root`. If you need to include packages from other images you can switch to the `root` user using `USER root` in your docker file and once you are done installing packages you can switch back to the atlantis user to start atlantis.

It is possible also to use the `/docker-entrypoint.d/` directory to add aditional scripts that you might want to run before the atlantis server starts. This is particulary useful if you want to customize the instance without building your own pipeline for it.

LGTM

It sounds like there needs to be some chowning too of custom files so it's owned by atlantis:atlantis instead of root:root

but that is because the root user used to own the files

Yes exactly and was necessary until atlantis stopped using root user

I can add that the atlantis data dir needs to readable by the atlantis user

For the sake of overloading the message, maybe we PR the documentation and then just point them there

Yeah all of this looks great. I could have done this myself in hindsight but a little bogged down at work, so thanks for adding this to the docs.