Docker substitution and file permissions
The following works in docker: docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve & ... but in podman: podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve & jekyll 3.8.5 | Error: Permission denied @ dir_s_mkdir - /srv/jekyll/_site pwd is a directory owned by me, and I'm running podman as me. What's missing here? -- -- Josh Berkus Kubernetes Community Red Hat OSAS
On 8/23/19 8:07 PM, Josh Berkus wrote:
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve &
jekyll 3.8.5 | Error: Permission denied @ dir_s_mkdir - /srv/jekyll/_site
pwd is a directory owned by me, and I'm running podman as me. What's missing here?
Does it work with root podman? If yes, then my guess would be SELinux, or a bad version of fuse-overlay?
On 8/25/19 5:02 AM, Daniel Walsh wrote:
Does it work with root podman?
If yes, then my guess would be SELinux, or a bad version of fuse-overlay?
Ooops, just realized that I never publicly responded to this. Yes, it works with root podman. In fact, it works with rootless podman *provided* that I run root podman first; the broken part seems to be the creation of the directories. Creation of regular files seems to work fine. I'm not getting any SELinux denial, but I am getting this error: SELinux: mount invalid. Same superblock, different security settings for (dev mqueue, type mqueue) which per here: https://bugzilla.redhat.com/show_bug.cgi?id=1425278 seems to be a possible problem? Testing with setenforce 0 did not fix the issue. -- -- Josh Berkus Kubernetes Community Red Hat OSAS
On 9/3/19 2:40 PM, Josh Berkus wrote:
On 8/25/19 5:02 AM, Daniel Walsh wrote:
Does it work with root podman?
If yes, then my guess would be SELinux, or a bad version of fuse-overlay? Ooops, just realized that I never publicly responded to this.
Yes, it works with root podman.
In fact, it works with rootless podman *provided* that I run root podman first; the broken part seems to be the creation of the directories. Creation of regular files seems to work fine.
I'm not getting any SELinux denial, but I am getting this error:
SELinux: mount invalid. Same superblock, different security settings for (dev mqueue, type mqueue)
which per here: https://bugzilla.redhat.com/show_bug.cgi?id=1425278 seems to be a possible problem? Testing with setenforce 0 did not fix the issue.
Well then I would bet it is NOT an SELinux issue.
Hi Josh, Josh Berkus <jberkus@redhat.com> writes:
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve &
is /srv on a network file system? In that case, it won't work with rootless, more info here: https://github.com/containers/libpod/blob/master/rootless.md#shortcomings-of... Regards, Giuseppe
On 8/23/19 8:07 PM, Josh Berkus wrote:
The following works in docker:
docker run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve &
... but in podman:
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages jekyll serve &
jekyll 3.8.5 | Error: Permission denied @ dir_s_mkdir - /srv/jekyll/_site
pwd is a directory owned by me, and I'm running podman as me. What's missing here?
I would guess that there is some permissions problem in /srv/jekyll. I would launch your container with a shell podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages /bin/sh And then check the permissions on the directory? then do a `mkdir /srv/jekyll/foo` If this fails, most likely is is something to do with User Namespace. Other ways to get permission denied would be seccomp and capilities, but since this works rootless, my guess would be this directory permissions do not map well into the usernamespace.
I would guess that there is some permissions problem in /srv/jekyll.
I would launch your container with a shell
podman run -p 4000:4000 -v $(pwd):/srv/jekyll:Z jekyll/jekyll:pages /bin/sh And then check the permissions on the directory?
then do a `mkdir /srv/jekyll/foo`
If this fails, most likely is is something to do with User Namespace.
So, it turns out that the upstream container is using su-exec to launch jekyll, which is why the directory creation has the wrong permissions (and fails). There's an obvious fix for me for this one container; however, my experience points out that it would be good to have a more generalized set of instructions for users who are downloading upstream Docker images that use su-exec in their entrypoints. -- -- Josh Berkus Kubernetes Community Red Hat OSPO
participants (3)
-
Daniel Walsh -
Giuseppe Scrivano -
Josh Berkus