如何为 postgres 日志文件夹设置卷 - 权限被拒绝错误

Question

Currently, I would like to mount logging folder for postgres, so that even after host machine restart, logging information is still preserved.

I use the following docker-compose.yml

docker-compose.yml

version: '2'
services:
  postgres:
    image: postgres:latest
    restart: always
    environment:
        - POSTGRES_USER=postgres
        - POSTGRES_PASSWORD=55F4rGFwsXXXXXX
    ports:
      - "5432:5432"
    volumes:
      - postgres_data:/var/lib/postgresql/data
      - postgres_logs:/logs
    # Make Postgres log to a file.
    # More on logging with Postgres: https://www.postgresql.org/docs/current/static/runtime-config-logging.html
    command: postgres -c logging_collector=on -c log_destination=stderr -c log_directory=/logs

volumes:
  postgres_data:
  postgres_logs:

However, I'm getting the following permission denied error.

postgres_1             | 2018-02-19 09:03:45.359 UTC [1] LOG:  database system is shut down
postgres_1             | 2018-02-19 09:04:45.963 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1             | 2018-02-19 09:04:45.963 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1             | 2018-02-19 09:04:45.965 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1             | 2018-02-19 09:04:45.972 UTC [1] FATAL:  could not open log file "/logs/postgresql-2018-02-19_090445.log": Permission denied
postgres_1             | 2018-02-19 09:04:45.974 UTC [1] LOG:  database system is shut down
postgres_1             | 2018-02-19 09:05:46.741 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1             | 2018-02-19 09:05:46.741 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1             | 2018-02-19 09:05:46.744 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1             | 2018-02-19 09:05:46.753 UTC [1] FATAL:  could not open log file "/logs/postgresql-2018-02-19_090546.log": Permission denied
postgres_1             | 2018-02-19 09:05:46.755 UTC [1] LOG:  database system is shut down
postgres_1             | 2018-02-19 09:06:47.366 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
postgres_1             | 2018-02-19 09:06:47.366 UTC [1] LOG:  listening on IPv6 address "::", port 5432
postgres_1             | 2018-02-19 09:06:47.368 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
postgres_1             | 2018-02-19 09:06:47.375 UTC [1] FATAL:  could not open log file "/logs/postgresql-2018-02-19_090647.log": Permission denied
postgres_1             | 2018-02-19 09:06:47.377 UTC [1] LOG:  database system is shut down

Anyone has idea how can I resolve such error?

Answer 1

2nd Edit

After some reading it seems that is not possible to do this the way you need. You would need to be able to define file ownership when declaring a volume with docker-compose, and this is something that is not supported by the docker engine. But there are a few workarounds that you can consider, check here for more details.

As a workaround you could create a Dockerfile extending postgres and add this:

# ...
RUN    mkdir /logs
RUN   chown postgres:postgres /logs

Edit

After some experimentation this is working:

version: '2'
services:
postgres:
    image: postgres:latest
    restart: always
    environment:
        - POSTGRES_USER=postgres
        - POSTGRES_PASSWORD=55F4rGFwsXXXXXX
    ports:
    - "5432:5432"
    volumes:
    - postgres_data:/var/lib/postgresql/data
    - ./:/logs:z
    # Make Postgres log to a file.
    # More on logging with Postgres: https://www.postgresql.org/docs/current/static/runtime-config-logging.html
    command: postgres -c logging_collector=on -c log_destination=stderr -c log_directory=/logs

volumes:
postgres_data:

Original answer

I accidentally got it working by doing this, first running docker-compose up with this docker-compose file:

version: '2'
services:
postgres:
    image: postgres:latest
    restart: always
    environment:
        - POSTGRES_USER=postgres
        - POSTGRES_PASSWORD=55F4rGFwsXXXXXX
    ports:
    - "5432:5432"
    volumes:
    - postgres_data:/var/lib/postgresql/data
    - postgres_logs:/logs:z
    # Make Postgres log to a file.
    # More on logging with Postgres: https://www.postgresql.org/docs/current/static/runtime-config-logging.html
    command: /bin/bash -c "mkdir -p /logs && chmod -R 777 /logs && postgres -c logging_collector=on -c log_destination=stderr -c log_directory=/logs"

volumes:
postgres_data:
postgres_logs:

This fails with:

postgres_1 | "root" execution of the PostgreSQL server is not permitted. postgres_1 | The server must be started under an unprivileged user ID to prevent postgres_1 | possible system security compromise. See the documentation for postgres_1 | more information on how to properly start the server.

After reverting the changes to command and running again then works, but obviously this is not a solution so stick with the edited answer above.

Answer 2

the problem is the permission in host, not in container.

so in host,

   chmod -R 777 postgres_logs