[BUG] 8.0.1 -> 8.0.2 can't create unixsocket

[nunojpg]

There was a regression with 8.0.2, where the following command now terminates:

docker run -v /run/redis:/data/sock redis:8.0.2 redis-server --unixsocket /data/sock/redis.sock

With 8.0.1 it would work fine:

docker run -v /run/redis:/data/sock redis:8.0.1 redis-server --unixsocket /data/sock/redis.sock

If you run 8.0.2 after 8.0.1 then it will succeed, because the volume has the right permissions set by the 8.0.1 invocation.

[Peter-Sh]

Hi @nunojpg,

Thanks for taking the time to report this, and sorry for the inconvenience.

Since version 8.0.2, this behavior is expected from the Redis entrypoint.

You may see a notice like the following in the container logs:

Notice: Unknown file './sock' found in data dir. Permissions will not be modified. Use SKIP_FIX_PERMS=1 to skip permission changes.

Permissions are now not changed if unexpected files or directories are found in the data or config directories. This is to avoid accidentally modifying permissions on incorrectly mounted paths - such as a user’s home directory.

I recommend not mounting the socket into the data directory.

If you want to manually adjust the socket directory's permissions on the host, you can run:

docker run -v /run/redis:/target redis:8.0.2 chown -R redis:redis /target

Alternatively, you can set the SKIP_DROP_PRIVS=1 environment variable to run Redis as root. However, this is not recommended, as it may reduce container security.

[nunojpg]

I see, thanks for explaining.

This makes it very hard to create a unix socket connection under a docker compose scenario.

redis-server needs to have permissions to connect to the socket file, unless of course we run as root.

I guess my trivial workaround is to add a .rdb extension to the folder:

docker run -v /run/redis:/data/sock.rdb redis:8.0.2 redis-server --unixsocket /data/sock.rdb/redis.sock

Considering this, and to avoid using this ugly rdb workaround, can you consider to add another hardcoded path, for example /sock/redis.sock that would also have permissions changed in the script?

[Peter-Sh]

Wow, clever trick! It's great to have such advanced users. 🙂

I don’t think we’d want to hard-code the socket path inside the data directory. I believe the right approach is to keep the data directory clean from non-data files.
There has been some discussion about eventually detecting whether a Unix socket is used and trying to fix its permissions automatically. However, that could introduce a lot of complexity and isn’t always feasible - Redis may be configured via stdin, the config might be split across multiple files, or, as in your case, the user might place the config file inside the data directory.

That said, thanks for reaching out - this kind of feedback really helps us understand which changes would be meaningful.

For a docker-compose setup, you might also consider the one-shot container approach mentioned in the other issue: #458 (comment)

[nunojpg]

You can also accept a ENV variable with a list of paths to also fix permissions.

[Peter-Sh]

Thank, @nunojpg the idea is interesting, but in general, we aim to keep the API as minimal as possible. The goal of permission fixes is to improve the user experience for common configurations.
As seen in various issues, the unixsocket is something we might need to account for.
No promises on a quick fix, but stay tuned!

[nunojpg]

Ok, thanks!