[英]How to allow IIS APPPOOL\DefaultAppPool to write into C:\inetpub\wwwroot mount point
I'm creating a new Windows docker compose which uses a microsoft/aspnet:4.6.2 image. 我正在创建一个使用microsoft / aspnet:4.6.2映像的新Windows docker compose。 I'm using a volume for c:\\inetpub\\wwwroot which is mapped with C:\\site\\Default on the host server. 我正在使用c:\\ inetpub \\ wwwroot的卷,该卷与主机服务器上的C:\\ site \\ Default映射。
The running ASP.Net file successfully retrieves files but files at creating/writing files. 正在运行的ASP.Net文件成功检索到文件,但在创建/写入文件时检索到文件。 I am getting the following exception: System.IO.IOException: 'Trying to write to forbidden path: C:\\inetpub\\WWWRoot\\agenda.css.'
我收到以下异常: System.IO.IOException: 'Trying to write to forbidden path: C:\\inetpub\\WWWRoot\\agenda.css.'
I tried the following: 我尝试了以下方法:
Set full access to everyone to C:\\site\\Default on the host server 将对所有人的完全访问权限设置为主机服务器上的C:\\ site \\ Default
Add all rights using icacls (see dockerfile below). 使用icacls添加所有权限(请参阅下面的dockerfile)。 Here is the output for (Get-acl c:\\inetpub\\wwwroot\\).Access
: 这是(Get-acl c:\\inetpub\\wwwroot\\).Access
:
FileSystemRights : FullControl AccessControlType : Allow IdentityReference : Everyone IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : None FileSystemRights : ReadAndExecute, Synchronize AccessControlType : Allow IdentityReference : BUILTIN\\IIS_IUSRS IsInherited : False InheritanceFlags : None PropagationFlags : None FileSystemRights : -1610612736 AccessControlType : Allow IdentityReference : BUILTIN\\IIS_IUSRS IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : InheritOnly FileSystemRights : FullControl AccessControlType : Allow IdentityReference : IIS APPPOOL\\DefaultAppPool IsInherited : False InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : None FileSystemRights : FullControl AccessControlType : Allow IdentityReference : NT SERVICE\\TrustedInstaller IsInherited : True InheritanceFlags : None PropagationFlags : None FileSystemRights : 268435456 AccessControlType : Allow IdentityReference : NT SERVICE\\TrustedInstaller IsInherited : True InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : InheritOnly FileSystemRights : FullControl AccessControlType : Allow IdentityReference : NT AUTHORITY\\SYSTEM IsInherited : True InheritanceFlags : None PropagationFlags : None FileSystemRights : 268435456 AccessControlType : Allow IdentityReference : NT AUTHORITY\\SYSTEM IsInherited : True InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : InheritOnly FileSystemRights : FullControl AccessControlType : Allow IdentityReference : BUILTIN\\Administrators IsInherited : True InheritanceFlags : None PropagationFlags : None FileSystemRights : 268435456 AccessControlType : Allow IdentityReference : BUILTIN\\Administrators IsInherited : True InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : InheritOnly FileSystemRights : ReadAndExecute, Synchronize AccessControlType : Allow IdentityReference : BUILTIN\\Users IsInherited : True InheritanceFlags : None PropagationFlags : None FileSystemRights : -1610612736 AccessControlType : Allow IdentityReference : BUILTIN\\Users IsInherited : True InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : InheritOnly FileSystemRights : 268435456 AccessControlType : Allow IdentityReference : CREATOR OWNER IsInherited : True InheritanceFlags : ContainerInherit, ObjectInherit PropagationFlags : InheritOnly
I used ProcMon on the host server and couldn't see any entry when trying to write the file 我在主机服务器上使用了ProcMon,尝试写入文件时看不到任何条目
docker-compose: 泊坞窗 - 撰写:
services:
core:
image: core
build:
context: .
dockerfile: ./core/dockerfile
volumes:
- C:/site/Default/:c:/inetpub/wwwroot:rw
ports:
- "8000:80"
- "4020-4024:4020-4024"
environment:
DatabaseType: SqlServer
ConnectionString: Server=sqldata;User ID=sa;Password=pAssword123;Database=Default;MultipleActiveResultSets=True
depends_on:
- sqldata
sqldata:
...
dockerfile: dockerfile:
FROM microsoft/aspnet:4.6.2
# Also tried the bellow command with /l
RUN icacls --% "C:\inetpub\wwwroot" /grant Everyone:(OI)(CI)F /t
For some reasons IUSR
has rights to write anywhere in the container folders (being mapped or not) except in C:\\inetpub\\wwwroot
. 由于某些原因, IUSR
有权在C:\\inetpub\\wwwroot
之外的容器文件夹中(无论是否映射)写入任何位置。 IIS prevents from writing into this particular path. IIS禁止写入此特定路径。
I ended up creating an app which uses another physical path from the dockerfile and everything works as expected now: 我最终创建了一个应用程序,该应用程序使用了来自dockerfile的另一个物理路径,并且现在一切都按预期进行了:
FROM microsoft/aspnet:4.6.2
RUN C:\Windows\system32\inetsrv\appcmd.exe set app \"Default Web Site/\" /physicalPath:C:\SomeOtherMountPoint
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.