如何为 Docker 容器内的附加卷设置权限？

Question

I'm trying to deploy the Prometheus docker container with persistent data via an NFS volume using a Docker named volume . I'm deploying with Ansible, so I'll post Ansible config, but I've executed the same using Docker's CLI commands and the issue presents in that case as well.

When I deploy the container and review the containers docker logs , I see that /etc/prometheus is shared appropriately and attached to the container. However, /prometheus , which is where the container stores relevant DB and metrics, gives permission denied.

According to this answer , /prometheus is required to be chown ed to nobody. This doesn't seem to happen within the container upon startup.

Here's the volume creation from my Ansible role:

  - name: "Creates named docker volume"
    docker_volume:
        volume_name: prometheus_persist
        state: present
        driver_options: 
            type: nfs
            o: "addr={{ nfs_server }},rw,nolock"
            device: ":{{ prometheus_nfs_path }}"

Which is equivalent to this Docker CLI command:

docker volume create -d local -o type=nfs -o o=addr={{ nfs_server }},rw -o device=:{{ prometheus_nfs_path }} prometheus_persist

Here's my container deployment stanza

  - name: "Deploy prometheus container"
    docker_container:
        name: prometheus
#        hostname: prometheus
        image: prom/prometheus
        restart_policy: always
        state: started
        ports: 9090:9090
        user: ansible:docker
        volumes:
          - "{{ prometheus_config_path }}:/etc/prometheus"
        mounts:
          - source: prometheus_persist
            target: /prometheus    
            read_only: no
            type: volume        
        comparisons:        
            env: strict

Which is equivalent to this Docker CLI command:

docker run -v prometheus_persist:/prometheus -v "{{ prometheus_config_path }}:/etc/prometheus" -p 9090:9090 --name prometheus prom/prometheus

Again, the container logs upon deployment indicate permission denied on /prometheus . I've tested by mounting the prometheus_persist named volume on a generic Ubuntu container, it mounts fine, and I can touch files within. Any advice on how to resolve this?

Answer 1

This turned out to be an issue with NFS squashing. The NFS exporter in my case is an old Synology, which doesn't allow no_root_squash to be set. However, mapping all users to admin on the NFS share resolved the issue.