无法在 Google Container-Optimized OS 上运行可执行的 shell 脚本

Question

On any other linux distro, I can create a file with a shebang and run shell scripts like so:

$ chmod +x test.sh
$ ./test.sh Johnny
hello Johnny

But on Google Cloud Platform Container-Optimized OS, I get -bash: ./test.sh: Permission denied

If I prefix with sh eg sh test.sh Johnny it will work. How can I get this to work normally?

$ cat test.sh
#!/usr/bin/env sh

echo "Hello $@"

matt@rancher-4mmm /tmp/matt $ chmod +x test.sh 
matt@rancher-4mmm /tmp/matt $ sh ./test.sh matt
Hello matt

matt@rancher-4mmm /tmp/matt $ ./test.sh matt
-bash: ./test.sh: Permission denied
matt@rancher-4mmm /tmp/matt $ ls -la
total 4
drwxr-xr-x  2 matt matt  60 Feb 28 20:00 .
drwxrwxrwt 14 root root 280 Feb 28 19:59 ..
-rwxr-xr-x  1 matt matt  35 Feb 28 20:00 test.sh

Answer 1

Most filesystems on a COS node are mounted with "noexec" flag so you can't execute binaries from them.

Some workarounds:

• For scripts, invoke the interpreter with the script as the argument, "bash /path/script.sh", "python /path/app.py"
• Mount an extra data disk under /mnt/disks. You can mount it without the "noexec" flag. Use startup-script to mount at boot.

Answer 2

Container-Optimized OS mounts the file-system with "noexec" flag except "Among the writable locations, only /var/lib/docker and /var/lib/cloud are mounted as "executable" (ie without the noexec mount flag)." [1] . You can verify with the following command:

mount | grep noexec

For more information on the layout of Container-Optimized OS (COS) file system, refer to the documentation . The 'noexec' option do not allow direct execution of any binaries on the mounted filesystem. This is because of by default security lock-down implementation on COS.

Answer 3

If you want to run a binary one-off and don't want to deal with having another PD, you could also just mount a tmpfs device and run it from there.

sudo mkdir /mnt/disks/scratch
sudo mount -t tmpfs tmpfs /mnt/disks/scratch/

Answer 4

One solution is to use another image family, eg ubuntu .

There, /tmp/ is not mounted with noexec .