feat: Rootless containers

[emrahcom]

This PR allows Jitsi containers to run without using root account.

Main changes:

• s6-overlay is upgraded to v3.2.0.2

• All processes are run by a non-root user: s6

• Currently, container's filesystem is still writable but the active user is s6. So, it cannot write into the root's folders.

• Config files are created in /run by using templates and provided config files (from /config)

• The writable folders for s6 are:

  • /run
  • /tmp
  • Folders in the mounted volumes with write permission (writable folders should have 777 as mode)

• Volumes are updated to differ read-only and writable volumes:

  • /config contains read-only config files
  • /storage contains created files during the runtime such as recordings, logs, etc.
  • /tmp contains created temporary files the runtime

• Expected folders on host:

mkdir -p ~/.jitsi-meet-cfg/prosody/{config,prosody-plugins-custom}
mkdir -p ~/.jitsi-meet-cfg/{jibri,jicofo,jigasi,jvb,web}

mkdir -p ~/.jitsi-meet-cfg/storage/{jibri,transcripts}
chmod 777 ~/.jitsi-meet-cfg/storage/jibri
chmod 777 ~/.jitsi-meet-cfg/storage/transcripts

mkdir -p ~/.jitsi-meet-cfg/tmp/{web-crontabs,web-load-test}
chmod 777 ~/.jitsi-meet-cfg/tmp/web-crontabs
chmod 777 ~/.jitsi-meet-cfg/tmp/web-load-test

• jibri container doesn't have CAPS_SYS_ADMIN anymore. Therfore Chrome is run with --no-sandbox.

My plan is to create a second PR to make container's filesystem completely read-only after a while. Actually this also works in my test but I don't want to make it harder to debug.

[saghul]

Impressive work @emrahcom ! 👏 I left some comments, please take a look!

[saghul]

Sorry for the exec comments, I got carried away during review ;-) I can make those after this lands.

[saghul]

I'll give this a try shortly @emrahcom, thanks a lot for the swift responses to my comments!

[emrahcom]

Thank you very much for your helps.

[saghul]

Hey @emrahcom quick update: I will start testing the end of this week or the next.

Something important we need to handle here is migrating the XMPP data from existing installations since it may contain user accounts.

[emrahcom]

I will check the option to use ~/.jitsi-meet-cfg/storage/prosody as Prosody's data_path.