Docker mount permissions on mac vs linux

user_2848436 0
Viewed 1457

I was trying to run elasticsearch using docker. And wanted to preserve the data using a volume. This was the command I used.

docker run -it --rm -v $(pwd)/elasticdata:/usr/share/elasticsearch/data elasticsearch:7.5.1

This ran fine on my Mac. But when I tried to run it in Travis CI, it failed with permission denied for /usr/share/elasticsearch/data/ directory.

Here's the inconsistency I noticed with the permissions of docker volumes on OSX vs Linux

OSX (Docker version 19.03.8, build afacb8b)

$ ls -l elasticdata/.keepme
-rw-r--r--  1 nikhil  staff  0 Apr  3 13:07 elasticdata/.keepme

$ docker run -it --rm -v $(pwd)/elasticdata:/usr/share/elasticsearch/data elasticsearch:7.5.1 namei -l /usr/share/elasticsearch/data/.keepme
f: /usr/share/elasticsearch/data/.keepme
drwxr-xr-x root          root /
drwxr-xr-x root          root usr
drwxr-xr-x root          root share
drwxrwxr-x elasticsearch root elasticsearch
drwxr-xr-x root          root data
-rw-r--r-- root          root .keepme <---------------- owned by root!

Ubuntu (Docker version 18.06.1-ce, build e68fc7a)

$ namei -l elasticdata/.keepme
f: elasticdata/.keepme
drwxrwxr-x nowalekar nowalekar elasticdata
-rw-rw-r-- nowalekar nowalekar .keepme

$ docker run -it --rm -v $(pwd)/elasticdata:/usr/share/elasticsearch/data elasticsearch:7.5.1 namei -l /usr/share/elasticsearch/data/.keepme
f: /usr/share/elasticsearch/data/.keepme
drwxr-xr-x root          root /
drwxr-xr-x root          root usr
drwxr-xr-x root          root share
drwxrwxr-x elasticsearch root elasticsearch
drwxrwxr-x 1013          1013 data
-rw-rw-r-- 1013          1013 .keepme

Is this inconsistency expected?

Am I hitting this : http://turnoff.us/geek/before-devops-after-devops/ ?

elasticsearch docker macos linux
1 Answers

Yes, it's is expected. Osxfs automatically maps container file ownership to that of the host for an easier development experience. Normally, a host volume will pass the uid/gid of the host directly into the container without any translation (unless you are using user namespaces, but that usually adds to this issue rather than resolves it). So if the directory is owned by uid 1003 on the host, that is the uid the file will have in the container.

Host volumes are implicitly not portable, they depend on the state of the host. For portability, switch to named volumes managed by docker. They include an initialization step when first created that tends to resolve permission issues.

user_5962850
Related