run corrosion in Docker as uncloud user, bind mount data dir

internal/machine/corroservice/config.go

@@ -6,6 +6,7 @@ import (
 	"github.com/BurntSushi/toml"
 	"net/netip"
 	"os"
+	"path/filepath"
 	"uncloud/internal/fs"
 )
 
@@ -57,3 +58,23 @@ func (c *Config) Write(path, owner string) error {
 	}
 	return nil
 }
+
+func MkDataDir(dir, owner string) error {
+	parent, _ := filepath.Split(dir)
+	// Use 0711 for parent directories to allow `owner` to access its nested data directory.
+	if err := os.MkdirAll(parent, 0711); err != nil {
+		return fmt.Errorf("create directory %q: %w", parent, err)
+	}
+	if err := os.Mkdir(dir, 0700); err != nil {
+		if !os.IsExist(err) {
+			return fmt.Errorf("create directory %q: %w", dir, err)
+		}
+	}
+
+	if owner != "" {
+		if err := fs.Chown(dir, owner); err != nil {
+			return err
+		}
+	}
+	return nil
+}

internal/machine/corroservice/docker.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"github.com/docker/docker/api/types/container"
 	"github.com/docker/docker/api/types/image"
+	"github.com/docker/docker/api/types/mount"
 	"github.com/docker/docker/api/types/network"
 	"github.com/docker/docker/client"
 	"io"
@@ -22,7 +23,7 @@ type DockerService struct {
 	Image   string
 	Name    string
 	DataDir string
-	// TODO: uid/guid
+	User    string
 }
 
 func NewDockerService(cli *client.Client, image, name, dataDir string) *DockerService {
@@ -71,6 +72,7 @@ func (s *DockerService) containerConfig() *container.Config {
 	return &container.Config{
 		Image: s.Image,
 		Cmd:   []string{"corrosion", "agent", "-c", filepath.Join(s.DataDir, "config.toml")},
+		User:  s.User,
 	}
 }
 
@@ -80,6 +82,14 @@ func (s *DockerService) hostConfig() *container.HostConfig {
 		RestartPolicy: container.RestartPolicy{
 			Name: container.RestartPolicyAlways,
 		},
+		Mounts: []mount.Mount{
+			// Bind mount the data directory at the same path inside the container to simplify path handling.
+			{
+				Type:   mount.TypeBind,
+				Source: s.DataDir,
+				Target: s.DataDir,
+			},
+		},
 	}
 }