starting jenkins container however encounter permission denied though I have run 'chown' for the volume

user_959734 0
Viewed 724

I am on my MacBook terminal. I try to have a jenkins container up and running on my local machine.

I firstly created a docker-compose.yml :

version: '3'
services:
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins
    ports:
      - "8080:8080"
    volumes:
      - $PWD/jenkins_home:/var/jenkins_home
    networks:
      - net
networks:
  net:

As you can see in the volumes section, I have defined the jenkins_home folder under my current directory as the volume for jenkins data.

Then under my current directory of my machine, I created a folder named jenkins_home. Here is my current directory:

-rw-r--r--  1 john 1349604816  220 Sep  4 00:08 docker-compose.yml
drwxr-xr-x  2 john 1349604816   64 Sep  4 00:06 jenkins_home

As you can see, I need to change the ownership of jenkins_home folder in order to have jenkins container be able to write data in it (because the uid is not 1000). So, I executed command:

sudo chown 1000:1000 jenkins_home/

Then, my current directory looks like this:

-rw-r--r--  1 john  1349604816  220 Sep  4 00:08 docker-compose.yml
drwxr-xr-x  2 1000     1000         64 Sep  4 00:06 jenkins_home

After that I run my container by command: docker-compose up. But I ended up with error:

Starting jenkins ... done
Attaching to jenkins
jenkins    | touch: cannot touch '/var/jenkins_home/copy_reference_file.log': Permission denied
jenkins    | Can not write to /var/jenkins_home/copy_reference_file.log. Wrong volume permissions?
jenkins exited with code 1

Why I still get the permission error after I changed the ownership of the jenkins_home folder under my current directory on my machine?

P.S. I understand there could be other way to purely have a jenkins container running but still I would like to understand what is wrong with my approach and hopefully could also get it work.

docker-compose docker jenkins macos
2 Answers

Jenkins needs to create or to use existing jenkins_home directory,

When Docker sees that jenkins_home volume in your machine doesn't exists then it will create it with your osx UID & GID.

If you create the jenkins_home folder you must stay with your current directory permissions and not changed them,

Docker running UID isn't the same as your machine, they may have different UID and GID.

Linux namespaces provide isolation for running processes, limiting their access to system resources without the running process being aware of the limitations. For more information on Linux namespaces, see Linux namespaces.

The best way to prevent privilege-escalation attacks from within a container is to configure your container’s applications to run as unprivileged users. For containers whose processes must run as the root user within the container, you can re-map this user to a less-privileged user on the Docker host. The mapped user is assigned a range of UIDs which function within the namespace as normal UIDs from 0 to 65536, but have no privileges on the host machine itself.

There a wonderful video explaining how docker works with namespaces

user_17065450

Does the actual jenkins user/group exist on the Mac? This is what I do on my linux servers where:

ARG user=jenkins
ARG group=jenkins
ARG uid=1000
ARG gid=1000

On my alpine server:

addgroup -g ${gid} ${group}
adduser -u ${uid} -G ${group} -s /bin/bash -D ${user}

to become

addgroup -g 1000 jenkins
adduser -u 1000 -G jenkins -s /bin/bash -D jenkins

On my centos8 server

groupadd -g ${gid} ${group}
useradd -u ${uid} -g ${group} -s /bin/bash -d ${user}

to become

groupadd -g 1000 jenkins
useradd -u 1000 -g jenkins -s /bin/bash -d jenkins

then:

sudo chown jenkins:jenkins jenkins_home/

I do not use Mac, but I presume it is similar

UPDATE Based on all the above, try the following: docker-compose.yml

version: '3'
services:
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins
    ports:
      - 8080:8080
      - 50000:50000
    volumes:
      - $PWD/jenkins_home:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - net
networks:
  net:

I have added the following:

  • port 50000 (only if you want to attach build slave servers, opposed to just running builds on the master)
  • volume /var/run/docker.sock (to be able to use the docker daemon with Jenkins, you need to mount the volume)

!!DO THE FOLLOWING!! Delete the original jenkins_home directory that you created before. Now run 'docker-compose up', since the host volume directory does not exist, docker will now create the required directory on the host which is based on the configuration in the docker-compose.yml (in this case '$PWD/jenkins_home'), thus it will now have the correct ownership and permissions for the jenkins container to use it.

If that doesn't work, make the jenkins container run in privileged mode, see below:

version: '3'
services:
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins
    privileged: true
    user: root
    ports:
      - 8080:8080
      - 50000:50000
    volumes:
      - $PWD/jenkins_home:/var/jenkins_home
      - /var/run/docker.sock:/var/run/docker.sock
    networks:
      - net
networks:
  net:
user_115430230
Related