How to set the permission of mounted directory when using docker #278

New issue

Open

opened 2022-06-07 11:45:49 +00:00 by duskmoon314 · 4 comments

duskmoon314 commented

2022-06-07 11:45:49 +00:00

(Migrated from gitlab.com)

Description

I'm trying to use Docker to deploy a server. And I have tried these two configurations:

volumes:
  - conduit:/var/lib/matrix-conduit

volumes:
  - "/data/conduit:/var/lib/matrix-conduit"

And I execute docker-compose as root, so the problem might have something to do with this.

warning: some trace filter directives would enable traces that are disabled statically
 | `info` would enable the INFO level for all targets
 = note: the static max level is `warn`
 = help: to enable INFO logging, remove the `max_level_warn` feature
The database couldn't be loaded or created. The following error occurred: There was a problem with the connection to the rocksdb database: IO error: While open directory: /var/lib/matrix-conduit: Permission denied

So I want to ask for help. How to correctly set the permission and deploy a server?

System Configuration

os: Linux 5.4.0-88-generic x86_64 GNU/Linux

Docker version 20.10.15

docker-compose version 1.29.2

docker-compose.yml:

conduit:
  image: matrixconduit/matrix-conduit:latest
  container_name: conduit
  restart: unless-stopped
  volumes:
    - "/data/conduit:/var/lib/matrix-conduit"
  networks:
    - traefik-net
  env_file:
    - .conduit.env
  labels:
    - "traefik.enable=true"
    - "traefik.http.routers.conduit.rule=Host(`matrix.$DOMAIN_NAME`)"
    - "traefik.http.routers.conduit.middlewares=cors-headers@docker"
    - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*"
    - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization"
    - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS"

.conduit.env:

CONDUIT_SERVER_NAME=matrix.mydomain.com
CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit
CONDUIT_DATABASE_BACKEND=rocksdb
CONDUIT_PORT=6167
CONDUIT_MAX_REQUEST_SIZE=20000000 # in bytes, ~20 MB
CONDUIT_ALLOW_REGISTRATION='true'
CONDUIT_ALLOW_FEDERATION='true'
CONDUIT_TRUSTED_SERVERS='["matrix.org"]'
#CONDUIT_MAX_CONCURRENT_REQUESTS=100
#CONDUIT_LOG=info,rocket=off,_=off,sled=off
CONDUIT_ADDRESS=0.0.0.0
CONDUIT_CONFIG='' # Ignore this

### Description I'm trying to use Docker to deploy a server. And I have tried these two configurations: ```YAML volumes: - conduit:/var/lib/matrix-conduit volumes: - "/data/conduit:/var/lib/matrix-conduit" ``` And I execute `docker-compose` as `root`, so the problem might have something to do with this. ``` warning: some trace filter directives would enable traces that are disabled statically | `info` would enable the INFO level for all targets = note: the static max level is `warn` = help: to enable INFO logging, remove the `max_level_warn` feature The database couldn't be loaded or created. The following error occurred: There was a problem with the connection to the rocksdb database: IO error: While open directory: /var/lib/matrix-conduit: Permission denied ``` So I want to ask for help. How to correctly set the permission and deploy a server? ### System Configuration  os: Linux 5.4.0-88-generic x86_64 GNU/Linux Docker version 20.10.15 docker-compose version 1.29.2 docker-compose.yml: ```YAML conduit: image: matrixconduit/matrix-conduit:latest container_name: conduit restart: unless-stopped volumes: - "/data/conduit:/var/lib/matrix-conduit" networks: - traefik-net env_file: - .conduit.env labels: - "traefik.enable=true" - "traefik.http.routers.conduit.rule=Host(`matrix.$DOMAIN_NAME`)" - "traefik.http.routers.conduit.middlewares=cors-headers@docker" - "traefik.http.middlewares.cors-headers.headers.accessControlAllowOriginList=*" - "traefik.http.middlewares.cors-headers.headers.accessControlAllowHeaders=Origin, X-Requested-With, Content-Type, Accept, Authorization" - "traefik.http.middlewares.cors-headers.headers.accessControlAllowMethods=GET, POST, PUT, DELETE, OPTIONS" ``` .conduit.env: ``` CONDUIT_SERVER_NAME=matrix.mydomain.com CONDUIT_DATABASE_PATH=/var/lib/matrix-conduit CONDUIT_DATABASE_BACKEND=rocksdb CONDUIT_PORT=6167 CONDUIT_MAX_REQUEST_SIZE=20000000 # in bytes, ~20 MB CONDUIT_ALLOW_REGISTRATION='true' CONDUIT_ALLOW_FEDERATION='true' CONDUIT_TRUSTED_SERVERS='["matrix.org"]' #CONDUIT_MAX_CONCURRENT_REQUESTS=100 #CONDUIT_LOG=info,rocket=off,_=off,sled=off CONDUIT_ADDRESS=0.0.0.0 CONDUIT_CONFIG='' # Ignore this ```

George-Miao commented

2022-06-07 20:36:11 +00:00

(Migrated from gitlab.com)

Same problem here. Also tried SQLite, no luck.

the database couldn't be loaded or created. The following error occured: There was a problem with the connection to the sqlite database: unable to open database file: /data/conduit.db

Command:

docker run -it --rm \
    --mount type=volume,src=conduit-data,dst=/data \
    -e CONDUIT_SERVER_NAME=my.matrix.host \
    -e CONDUIT_DATABASE_BACKEND=sqlite \
    -e CONDUIT_DATABASE_PATH=/data\
    matrixconduit/matrix-conduit:next

Same problem here. Also tried SQLite, no luck. ``` the database couldn't be loaded or created. The following error occured: There was a problem with the connection to the sqlite database: unable to open database file: /data/conduit.db ``` Command: ``` docker run -it --rm \ --mount type=volume,src=conduit-data,dst=/data \ -e CONDUIT_SERVER_NAME=my.matrix.host \ -e CONDUIT_DATABASE_BACKEND=sqlite \ -e CONDUIT_DATABASE_PATH=/data\ matrixconduit/matrix-conduit:next ```

duskmoon314 commented

2022-06-11 11:46:37 +00:00

(Migrated from gitlab.com)

I find a not elegant way to solve this: chown -R 777 /data/conduit 😂

It seems the user in the docker is conduit(1000), but setting the user of /data/conduit to 1000 does not help. So I set it to 777 and it works.

I find a `not elegant` way to solve this: `chown -R 777 /data/conduit` 😂 It seems the user in the docker is `conduit(1000)`, but setting the user of `/data/conduit` to `1000` does not help. So I set it to 777 and it works.

scott.harper commented

2023-06-10 07:46:21 +00:00

(Migrated from gitlab.com)

More or less the same thing seems to work for me. Would love it if this could be worked out to not need "everyone read/write" on my folders 😓

More or less the same thing seems to work for me. Would love it if this could be worked out to not need "everyone read/write" on my folders :sweat:

zicklag commented

2024-02-02 00:00:42 +00:00

(Migrated from gitlab.com)

I've just deployed conduit with the docker container. I was able to do chown -R 1000:1000 /data/conduit.

It seems like @duskmoon314 wasn't able to do that above for some reason, but it worked for me.

Another possible workaround that weakens security would be to set the user of the container to root instead of the conduit user that it defaults to, but you shouldn't have to do that.

I've just deployed conduit with the docker container. I was able to do `chown -R 1000:1000 /data/conduit`. It seems like @duskmoon314 wasn't able to do that above for some reason, but it worked for me. Another possible workaround that weakens security would be to set the user of the container to `root` instead of the conduit user that it defaults to, but you shouldn't have to do that.