Migrate Container User IDs

This page describes how to migrate Pulse containers from the default container user ID (UID) and group ID (GID) to a custom UID/GID, roll back the changes if required, and verify that the deployment completed successfully.

The procedures in this topic are validated using a migration from 1000:1000 to 1007:1007, but the same steps apply to any supported UID/GID combination.

Before you begin

Ensure that:

• You have access to the target VM with permission to edit files under /data01/acceldata and manage Docker containers.
• The required deployer image is available and correctly tagged for your environment.
• You understand that accelo deploy core might prompt you to repair the deployment stack if the database is unavailable.
• You update ownership for all host-mounted directories, including /data01/acceldata/vendor.

Migrate to a Custom Container User ID

Use this procedure to migrate containers from the default 1000:1000 UID/GID to a custom UID/GID, such as 1007:1007.

Steps:

1. Open the following configuration file:

/data01/acceldata/config/accelo.yml

1. Update the ContainerUserID value.

Example:

ContainerUserID: "1007:1007"

1. Remove all existing ad-* containers so that they are recreated with the new runtime user.

 
for c in $(docker ps -a --format '{{.Names}}' | grep '^ad-'); do
  docker rm -f "$c"
done

1. Update ownership for all required host directories, including the vendor directory.

chown -R 1007:1007 \
  /data01/acceldata/config \
  /data01/acceldata/data \
  /data01/acceldata/logs \
  /data01/acceldata/tmp \
  /data01/acceldata/work \
  /data01/acceldata/vendor
 
chmod 755 /data01/acceldata/vendor
 

1. Deploy the core services.

accelo deploy core

If prompted that the database is unavailable and asked whether to repair the deployment stack, enter y.

1. Push the updated configuration to the database.

accelo admin database push-config -a

1. Deploy the add-on services.

accelo deploy addons

1. Deploy the Hydra agent.

accelo deploy hydra

 When prompted, enter y.

Roll Back to the Default Container User ID

Use these steps to restore the default container UID/GID (1000:1000).

Steps:

1. Open the following configuration file:

/data01/acceldata/config/accelo.yml

1. Update the ContainerUserID value.

ContainerUserID: "1000:1000"

1. Remove all existing ad-* containers.

 
for c in $(docker ps -a --format '{{.Names}}' | grep '^ad-'); do
  docker rm -f "$c"
done
 

1. Restore ownership for all required host directories.

chown -R 1000:1000 \
  /data01/acceldata/config \
  /data01/acceldata/data \
  /data01/acceldata/logs \
  /data01/acceldata/tmp \
  /data01/acceldata/work \
  /data01/acceldata/vendor
 
chmod 755 /data01/acceldata/vendor
 

1. Deploy the core services.

accelo deploy core

 If prompted to repair the deployment stack, enter y.

1. Push the updated configuration to the database.

accelo admin database push-config -a

1. Deploy the add-on services.

accelo deploy addons

1. Deploy the Hydra agent.

accelo deploy hydra

Verify the Migration or Rollback

After completing the migration or rollback, verify that the containers are running with the expected UID/GID.

Run the following command:

for c in $(docker ps --format '{{.Names}}'); do
  echo -n "$c -> "
  docker inspect "$c" --format '{{.Config.User}}'
done
 

Expected results:

Verify the Deployer

Run the following command:

docker logs ad-deployer_default 2>&1 | grep -E "bootstrap inventory hosts count|No user exists"

Verify the following:

• The output includes:

bootstrap inventory hosts count: 3

• The output does not contain:

No user exists for uid ...

The deployment is successful if the deployer reports the expected host inventory count and does not report any UID lookup failures.

Validation Notes

The migration and rollback procedures were validated on a test VM. During validation, the following behaviors were confirmed:

• Always update ownership for /data01/acceldata/vendor. The deployer depends on this directory.
• Run accelo deploy core before accelo admin database push-config -a so that the database is available when the configuration is pushed.
• Some warnings can appear during Hydra deployment because of existing target-host issues. These warnings do not indicate a container UID migration failure.
• ad-logstash always runs as 1000:1000 by design and does not inherit the configured ContainerUserID.
• After the migration, all other ad-* containers run using the configured custom UID/GID. After rollback, all containers return to the default 1000:1000 UID/GID.