Can't write to bind mount on ECS Fragate when using non-root user

Question

I'm using ECS with Fargate and trying to create a bind mount on ephemeral storage but my user (id 1000) is unable to write to the volume.

According to the documentation , it should be possible.

However the documentation mentions:

By default, the volume permissions are set to 0755 and the owner as root. These permissions can be customized in the Dockerfile.

So in my Dockerfile I have

ARG PHP_VERSION=8.1.2-fpm-alpine3.15
FROM php:$PHP_VERSION as php_base

ENV APP_USER=app
ENV APP_USER_HOME=/home/app
ENV APP_USER_UID=1000
ENV APP_USER_GID=1000
ENV APP_HOME=/srv/app

# create the app user
RUN set -eux; \
    addgroup -g $APP_USER_GID -S $APP_USER; \
    adduser -S -D -h "$APP_USER_HOME" -u $APP_USER_UID -s /sbin/nologin -G $APP_USER -g $APP_USER $APP_USER

RUN set -eux; \
    mkdir -p /var/run/php; \
    chown -R ${APP_USER}:${APP_USER} /var/run/php; \
    # TODO THIS IS A TEST
    chmod 777 /var/run/php
# ...

FROM php_base as php_prod

# ...

VOLUME ["/var/run/php"]
USER $APP_USER
WORKDIR "${APP_HOME}"
ENTRYPOINT ["/usr/local/bin/docker-php-entrypoint"]
CMD ["php-fpm"]

And in my task definition I have:

{
    "taskDefinitionArn": "arn:aws:ecs:us-east-1:999999999999:task-definition/app:2",
    "containerDefinitions": [
        {
            "name": "app-php",
            "image": "999999999999.dkr.ecr.us-east-1.amazonaws.com/php:latest",
            "cpu": 0,
            "portMappings": [],
            "essential": true,
            "environment": [
                {
                    "name": "DATABASE_PORT",
                    "value": "3306"
                },
                {
                    "name": "DATABASE_USERNAME",
                    "value": "app"
                },
                {
                    "name": "DATABASE_NAME",
                    "value": "app"
                },
                {
                    "name": "DATABASE_HOST",
                    "value": "db.xxxxxxxxxxxx.us-east-1.rds.amazonaws.com"
                }
            ],
            "mountPoints": [
                {
                    "sourceVolume": "php_socket",
                    "containerPath": "/var/run/php",
                    "readOnly": false
                }
            ],
            "volumesFrom": [],
            "secrets": [
                {
                    "name": "DATABASE_PASSWORD",
                    "valueFrom": "arn:aws:ssm:us-east-1:999999999999:parameter/db-password"
                }
            ],
            "readonlyRootFilesystem": false,
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-group": "app",
                    "awslogs-region": "us-east-1",
                    "awslogs-stream-prefix": "app"
                }
            },
            "healthCheck": {
                "command": [
                    "docker-healthcheck"
                ],
                "interval": 10,
                "timeout": 3,
                "retries": 3,
                "startPeriod": 15
            }
        },
        {
            "name": "app-proxy",
            "image": "999999999999.dkr.ecr.us-east-1.amazonaws.com/proxy:latest",
            "cpu": 0,
            "portMappings": [
                {
                    "containerPort": 80,
                    "hostPort": 80,
                    "protocol": "tcp"
                }
            ],
            "essential": true,
            "environment": [],
            "mountPoints": [
                {
                    "sourceVolume": "php_socket",
                    "containerPath": "/var/run/php",
                    "readOnly": false
                }
            ],
            "volumesFrom": [],
            "dependsOn": [
                {
                    "containerName": "app-php",
                    "condition": "HEALTHY"
                }
            ],
            "readonlyRootFilesystem": false,
            "logConfiguration": {
                "logDriver": "awslogs",
                "options": {
                    "awslogs-group": "app",
                    "awslogs-region": "us-east-1",
                    "awslogs-stream-prefix": "app"
                }
            },
            "healthCheck": {
                "command": [
                    "curl",
                    "-s",
                    "localhost/status-nginx"
                ],
                "interval": 10,
                "timeout": 3,
                "retries": 3,
                "startPeriod": 15
            }
        }
    ],
    "family": "bnc-stage-remises-app",
    "taskRoleArn": "arn:aws:iam::999999999999:role/app-task",
    "executionRoleArn": "arn:aws:iam::999999999999:role/app-exec",
    "networkMode": "awsvpc",
    "revision": 2,
    "volumes": [
        {
            "name": "php_socket",
            "host": {}
        }
    ],
    "status": "ACTIVE",
    "requiresAttributes": [
        {
            "name": "com.amazonaws.ecs.capability.logging-driver.awslogs"
        },
        {
            "name": "ecs.capability.execution-role-awslogs"
        },
        {
            "name": "com.amazonaws.ecs.capability.ecr-auth"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.19"
        },
        {
            "name": "com.amazonaws.ecs.capability.task-iam-role"
        },
        {
            "name": "ecs.capability.container-health-check"
        },
        {
            "name": "ecs.capability.container-ordering"
        },
        {
            "name": "ecs.capability.execution-role-ecr-pull"
        },
        {
            "name": "ecs.capability.secrets.ssm.environment-variables"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.18"
        },
        {
            "name": "ecs.capability.task-eni"
        },
        {
            "name": "com.amazonaws.ecs.capability.docker-remote-api.1.29"
        }
    ],
    "placementConstraints": [],
    "compatibilities": [
        "EC2",
        "FARGATE"
    ],
    "requiresCompatibilities": [
        "FARGATE"
    ],
    "cpu": "256",
    "memory": "2048",
    "registeredAt": "2022-02-15T15:54:47.452Z",
    "registeredBy": "arn:aws:sts::999999999999:assumed-role/OrganizationAccountAccessRole/9999999999999999999",
    "tags": [
        {
            "key": "Project",
            "value": "project-name"
        },
        {
            "key": "Environment",
            "value": "stage"
        },
        {
            "key": "ManagedBy",
            "value": "Terraform"
        },
        {
            "key": "Client",
            "value": "ClientName"
        },
        {
            "key": "Namespace",
            "value": "client-name"
        },
        {
            "key": "Name",
            "value": "app"
        }
    ]
}

However, in ECS I keep getting

2022-02-15T20:36:14.679Z    [15-Feb-2022 20:36:14] ERROR: unable to bind listening socket for address '/var/run/php/php-fpm.sock': Permission denied (13)   app-php
2022-02-15T20:36:14.679Z    [15-Feb-2022 20:36:14] ERROR: unable to bind listening socket for address '/var/run/php/php-fpm.sock': Permission denied (13)   app-php
2022-02-15T20:36:14.679Z    [15-Feb-2022 20:36:14] ERROR: FPM initialization failed app-php
2022-02-15T20:36:14.679Z    [15-Feb-2022 20:36:14] ERROR: FPM initialization failed app-php

Answer 1

Turns out /var/run is a symlink to /run in my container and ECS wasn't able to handle this. I changed my setup to use /run/php instead of /var/run/php and everything works perfectly.