chown error on bind mount when trying to launch postgres via docker compose

[valouille]

Rancher Desktop Version

0.7.1

Rancher Desktop K8s Version

1.22.5

What operating system are you using?

macOS

Operating System / Build Version

macOS Monterey 12.1

What CPU architecture are you using?

arm64 (Apple Silicon)

Windows User Only

No response

Actual Behavior

When trying to launch a Postgres container with a bind mount, it doesn't work because of a chown related error to the folder at startup

Steps to Reproduce

Clone the repo https://github.com/docker/awesome-compose, go to the folder nginx-golang-postgres, edit the file docker-compose.yml to use a bind mount like the following

services:
  backend:
    build: backend
    secrets:
      - db-password
    depends_on:
      - db
  db:
    image: postgres
    restart: always
    secrets:
      - db-password
    volumes:
      - $PWD/db-data:/var/lib/postgresql/data
    environment:
      - POSTGRES_DB=example
      - POSTGRES_PASSWORD_FILE=/run/secrets/db-password
    expose:
      - 5432

  proxy:
    build: proxy
    ports:
      - 8000:8000
    depends_on:
      - backend
#volumes:
#  db-data:
secrets:
  db-password:
    file: db/password.txt

Run the following command: docker compose up

Result

Error response from daemon: error while creating mount source path '~/github.com/docker/awesome-compose/nginx-golang-postgres/db-data': chown ~/github.com/docker/awesome-compose/nginx-golang-postgres/db-data: permission denied

Expected Behavior

I would expect to be able to access locally the folder as a bind mount in order to access and modify the files directly

Additional Information

No response

[guild-jonathan-kaczynski]

Rancher Desktop Version

0.7.1 and 1.0.0-beta.1

Rancher Desktop K8s Version

1.23.1 (latest), using the dockerd (moby) container runtime

What operating system are you using?

macOS

Operating System / Build Version

macOS Catalina 10.15.7 (19H1615)

What CPU architecture are you using?

x86-64 (Intel)

Windows User Only

No response

Actual Behavior

Trying to chown a folder mounted as a volume, from inside the container fails with a permission error.

Steps to Reproduce

Here is some of the output from running the endpoint script manually, if it helps any.

$ mkdir ./postgres

$ ls -ld ./postgres
drwxr-xr-x  2 jonathankaczynski  staff  64 Jan 24 13:38 ./postgres

$ docker run --rm -it \
    --entrypoint /bin/bash \
    -v "$(pwd)/postgres:/var/lib/postgresql/data" \
    postgres

root@98a1f91309fc:/# bash -x /usr/local/bin/docker-entrypoint.sh postgres
… snip …
+ docker_create_db_directories
+ local user
++ id -u
+ user=0
+ mkdir -p /var/lib/postgresql/data
+ chmod 700 /var/lib/postgresql/data
+ mkdir -p /var/run/postgresql
+ chmod 775 /var/run/postgresql
+ '[' -n '' ']'
+ '[' 0 = 0 ']'
+ find /var/lib/postgresql/data '!' -user postgres -exec chown postgres '{}' +

root@ff5dae1c266d:/# find /var/lib/postgresql/data '!' -user postgres
/var/lib/postgresql/data

root@ff5dae1c266d:/# ls -ld /var/lib/postgresql/data
drwx------ 1 501 dialout 64 Jan 24 18:32 /var/lib/postgresql/data

root@ff5dae1c266d:/# exit
exit

$ ls -ld ./postgres
drwx------  2 jonathankaczynski  staff  64 Jan 24 13:32 ./postgres

[guild-jonathan-kaczynski]

Here's a minimal test case derived from the above practical example.

There seem to be two potentially independent mounted volume errors.

The first error relates to the mounted volume not existing on the host os (macos) prior to running the docker command.

$ ls -ld ./foobar
ls: ./foobar: No such file or directory

$ docker run --rm -it -v "$(pwd)/foobar:/opt/foobar" debian:bullseye-slim
docker: Error response from daemon: error while creating mount source path '/Users/jonathankaczynski/foobar': chown /Users/jonathankaczynski/foobar: permission denied.

$ ls -ld ./foobar
drwxr-xr-x  2 jonathankaczynski  staff  64 Jan 24 14:50 ./foobar

$ docker run --rm -it -v "$(pwd)/foobar:/opt/foobar" debian:bullseye-slim

root@392147ccc4f5:/# exit
exit

The second error relates to attempting to change the ownership of the mount point within the docker container. Though changing the file mode succeeds.

$ mkdir ./foobar

$ docker run --rm -it -v "$(pwd)/foobar:/opt/foobar" debian:bullseye-slim

root@cc1c034865bd:/# ls -ld /opt/foobar
drwxr-xr-x 1 501 dialout 64 Jan 24 19:50 /opt/foobar

root@cc1c034865bd:/# groupadd -r postgres --gid=999

root@cc1c034865bd:/# useradd -r -g postgres --uid=999 postgres

root@cc1c034865bd:/# chown postgres /opt/foobar
chown: changing ownership of '/opt/foobar': Permission denied

root@cc1c034865bd:/# chmod 700 /opt/foobar

root@cc1c034865bd:/# exit
exit

$ ls -ld ./foobar
drwx------  2 jonathankaczynski  staff  64 Jan 24 14:50 ./foobar

[luiz290788]

I'm having the same problem, this is the only thing holding me from using Rancher Desktop. Any progress here?

[jeesmon]

MacOS, RD v1.0.0

Getting permission error when running postgres image with bind-mount (-v $(pwd):/var/lib/pgsql/data)

docker run --rm --name postgresql -e POSTGRESQL_DATABASE=my-db -e POSTGRESQL_USER=user -e POSTGRESQL_PASSWORD=pass -p 5432:5432 -v $(pwd):/var/lib/pgsql/data centos/postgresql-96-centos7

The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/pgsql/data/userdata ... ok
creating subdirectories ... ok
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting dynamic shared memory implementation ... posix
creating configuration files ... ok
running bootstrap script ... FATAL:  could not read block 2 in file "base/1/1255_fsm": read only 0 of 8192 bytes
PANIC:  cannot abort transaction 1, it was already committed
child process was terminated by signal 6: Aborted
initdb: removing contents of data directory "/var/lib/pgsql/data/userdata"

But if I use named volume (-v postgres-data:/var/lib/pgsql/data), it works fine

docker run --rm --name postgresql -e POSTGRESQL_DATABASE=my-db -e POSTGRESQL_USER=user -e POSTGRESQL_PASSWORD=pass -p 5432:5432 -v postgres-data:/var/lib/pgsql/data centos/postgresql-96-centos7

The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/pgsql/data/userdata ... ok
creating subdirectories ... ok
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting dynamic shared memory implementation ... posix
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok

Success. You can now start the database server using:

    pg_ctl -D /var/lib/pgsql/data/userdata -l logfile start


WARNING: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.
waiting for server to start....LOG:  redirecting log output to logging collector process
HINT:  Future log output will appear in directory "pg_log".
 done
server started
/var/run/postgresql:5432 - accepting connections
=> sourcing /usr/share/container-scripts/postgresql/start/set_passwords.sh ...
ALTER ROLE
waiting for server to shut down.... done
server stopped
Starting server...
LOG:  redirecting log output to logging collector process
HINT:  Future log output will appear in directory "pg_log".

docker volume list
DRIVER    VOLUME NAME
local     postgres-data

[petersondrew]

I think this may be an issue with the underlying lima. I experience the exact same behavior using either Rancher Desktop or colima.

Possibly related lima-vm/lima#504

[guild-jonathan-kaczynski]

They converted that issue into a discussion lima-vm/lima#505 marked it as answered.

sshfs isn't robust (and fast) enough to be used as /var/lib/postgresql.
Please use lima nerdctl volume create to create a named volume inside the guest ext4 filesystem.

To me, it doesn't feel like the answer is addressing the broader concerns raised above.

[guild-jonathan-kaczynski]

There's also this earlier issue thread: lima-vm/lima#231

The last comment, which is from Dec, was:

The plan is to use mapped-xattr or mapped-file of virtio 9P, but the patch is not merged for macOS hosts yet, and seems to need more testers: NixOS/nixpkgs#122420

[willcohen]

As a followup, the latest version of the patch is https://gitlab.com/wwcohen/qemu/-/tree/9p-darwin and that's where the in-progress work will go as it progresses towards resubmission upstream. Any comments on how to improve would be GREATLY welcomed before I submit again.