主机和Docker容器之间的卷和权限

Question

I'm trying to dockerize all of the services on my host machine. But I'm running into the following problems with Docker and volume-permissions between host and docker.

I have a host machine with the following folder-structure:

- /data/mysql (user: docker-mysql)
- /data/gitlab (user: docker-gitlab)
- /data/backup (user: share-backup)

The /data/mysql:/mnt/mysql folder is getting mounted into the mysql docker container. The docker mysql container creates backups every 24 hours, but because the docker container runs on user root these backups get created as user root and group root in the /data/mysql folder.

My goal to achieve is that files in the /data/mysql folder will get created as docker-mysql user, not as root user.

I tried to change the user of the docker container to another user by setting RUN groupadd -r docker-mysql && useradd -r -g docker-mysql docker-mysql and USER docker-mysql , but then the mysql container won't even start anymore, because the docker-mysql user doesn't seem to have root permissions. I also tried this on the Gitlab-CE docker image, but ran into the same issue that running Gitlab-CE as a different user throws permission errors.

Any idea how to write files to for example /data/mysql on the host with the correct user?

Answer 1

Despite of your mysql image, what you need is: every process inside your container must be executed as a non-root user . There is some workarounds for it, but I suggest that you first dive into your mysql base image and see what is happening under the hood. One method is redirecting every process to a non-root user . This can be achieved by:

On your Dockerfile

RUN groupadd -r docker-mysql && useradd -r -g docker-mysql docker-mysql

ENTRYPOINT ["docker-entrypoint.sh"]
CMD ["mysqld"] ##CHECK YOUR IMAGE FIRST

Those two can be translated as

docker-entrypoint.sh mysqld

Now on your docker-entrypoint.sh, which need to be modified if the image is not the same as this example (it was from a mongodb which uses ubuntu as OS base image ) :

if [[ “$originalArgOne” == mysql* ]] && [ “$(id -u)” = ‘0’ ]; then
    if [ “$originalArgOne” = ‘mysqld’ ];
        then chown -R docker-mysql <MYSQL FOLDERS in CONTAINER>
    fi 
    # make sure we can write to stdout and stderr as “mongodb”
    # (for our “initdb” code later; see “ — logpath” below)
    chown --dereference docker-mysql “/proc/$$/fd/1” “/proc/$$/fd/2” || :
    exec gosu docker-mysql “$BASH_SOURCE” “$@”
fi

This answer was just adapted from here (It's a good reading)