7:07 p.m.
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
jekyll 3.8.5 | Error: Permission denied @ dir_s_mkdir - /srv/jekyll/_site
pwd is a directory owned by me, and I'm running podman as me. What's
missing here?
--
--
Josh Berkus
Kubernetes Community
Red Hat OSAS
7:02 a.m.
On 8/23/19 8:07 PM, Josh Berkus wrote:
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
jekyll 3.8.5 | Error: Permission denied @ dir_s_mkdir - /srv/jekyll/_site
pwd is a directory owned by me, and I'm running podman as me. What's
missing here?
Does it work with root podman?
If yes, then my guess would be SELinux, or a bad version of fuse-overlay?
1:40 p.m.
On 8/25/19 5:02 AM, Daniel Walsh wrote:
Does it work with root podman?
If yes, then my guess would be SELinux, or a bad version of fuse-overlay?
Ooops, just realized that I never publicly responded to this.
Yes, it works with root podman.
In fact, it works with rootless podman *provided* that I run root podman
first; the broken part seems to be the creation of the directories.
Creation of regular files seems to work fine.
I'm not getting any SELinux denial, but I am getting this error:
SELinux: mount invalid. Same superblock, different security settings
for (dev mqueue, type mqueue)
which per here: https://bugzilla.redhat.com/show_bug.cgi?id=1425278
seems to be a possible problem? Testing with setenforce 0 did not fix
the issue.
--
--
Josh Berkus
Kubernetes Community
Red Hat OSAS
10:43 a.m.
On 9/3/19 2:40 PM, Josh Berkus wrote:
On 8/25/19 5:02 AM, Daniel Walsh wrote:
> Does it work with root podman?
>
> If yes, then my guess would be SELinux, or a bad version of fuse-overlay?
Ooops, just realized that I never publicly responded to this.
Yes, it works with root podman.
In fact, it works with rootless podman *provided* that I run root podman
first; the broken part seems to be the creation of the directories.
Creation of regular files seems to work fine.
I'm not getting any SELinux denial, but I am getting this error:
SELinux: mount invalid. Same superblock, different security settings
for (dev mqueue, type mqueue)
which per here: https://bugzilla.redhat.com/show_bug.cgi?id=1425278
seems to be a possible problem? Testing with setenforce 0 did not fix
the issue.
Well then I would bet it is NOT an SELinux issue.
8 a.m.
Hi Josh,
Josh Berkus <jberkus(a)redhat.com> writes:
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
is /srv on a network file system?
In that case, it won't work with rootless, more info here:
https://github.com/containers/libpod/blob/master/rootless.md#shortcomings...
Regards,
Giuseppe
10:47 a.m.
On 8/23/19 8:07 PM, Josh Berkus wrote:
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages
jekyll serve &
jekyll 3.8.5 | Error: Permission denied @ dir_s_mkdir - /srv/jekyll/_site
pwd is a directory owned by me, and I'm running podman as me. What's
missing here?
I would guess that there is some permissions problem in /srv/jekyll.
I would launch your container with a shell
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages /bin/sh
And then check the permissions on the directory?
then do a `mkdir /srv/jekyll/foo`
If this fails, most likely is is something to do with User Namespace.
Other ways to get permission denied would be seccomp and capilities, but since this works
rootless,
my guess would be this directory permissions do not map well into the usernamespace.
1:31 p.m.
I would guess that there is some permissions problem in /srv/jekyll.
I would launch your container with a shell
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages /bin/sh
And then check the permissions on the directory?
then do a `mkdir /srv/jekyll/foo`
If this fails, most likely is is something to do with User Namespace.
So, it turns out that the upstream container is using su-exec to launch
jekyll, which is why the directory creation has the wrong permissions
(and fails).
There's an obvious fix for me for this one container; however, my
experience points out that it would be good to have a more generalized
set of instructions for users who are downloading upstream Docker images
that use su-exec in their entrypoints.
--
--
Josh Berkus
Kubernetes Community
Red Hat OSPO
1933
days inactive
1950
days old
6 comments
3 participants
participants (3)
-
Daniel Walsh -
Giuseppe Scrivano -
Josh Berkus