apache / apache/pulsar-manager

Wired folder permission on my Kubernetes environment. The /tmp folder become 1755 after emptyDir mounted.

Open
#271 1 comment 0 reactions 0 assignees View on GitHub
triage/week-15
Dominant language
Vue
Stars
539
Forks
239
PR merge metrics
No merged PRs in 30d

Description

Hey guys, I met a strange question: last week while I was trying to run pulsar-manager on my own environment(by Helm), there's an error occurred, PG cannot start normally.

Firstly, the `entrypoint.sh` will generate some init-files, create a non-root user, then switch to a non-root user `pulsar` to startup a PostgreSQL inside the container. When PG try to start on non-root user, "Permission Denied" occurred while writing .pid file to `/tmp`. At last, pg could not start. I noticed that there' `rwxr-xr-xt` on `/tmp`, non-root user could not write inside it.

In my opinion `/tmp` dir should be always 1777. But after some test, the problem image(pulsar-manager)'s `/tmp` would magically become 1755 after emptyDir mounted. But it will stay normal without volumeMount, or just run by `docker run -it --rm --entrypoint "/bin/sh" apachepulsar/pulsar-manager:v0.1.0`

I couldn't figure out why it's happening.

In order to prevent problems just relate to my own environment, I have simplified the re-produce steps as much as possible. Anyone with a Kubernetes env could do a quick run within 2 minutes.

Below are reproducible steps with two YAML(basically differ by image) and clean up cmd:

first.yaml
```yaml
apiVersion: v1
kind: Pod
metadata:
name: test-container
spec:
containers:
- image: ubuntu
name: test-container
command: [ "/bin/bash" ]
args: [ "-c", "id; touch /tmp/test-file; ls -l /" ]
volumeMounts:
- name: tmp-volume
mountPath: /data
restartPolicy: Never
volumes:
- name: tmp-volume
emptyDir: {}
```

second.yaml
```yaml
apiVersion: v1
kind: Pod
metadata:
name: test-container
spec:
containers:
- image: apachepulsar/pulsar-manager:v0.1.0
name: test-container
command: [ "/bin/sh" ]
args: [ "-c", "id; touch /tmp/test-file; ls -l /" ]
volumeMounts:
- name: tmp-volume
mountPath: /data
subPath: data
restartPolicy: Never
volumes:
- name: tmp-volume
emptyDir: {}
```

How to reproduce:

needs a Kubernetes environment

```bash
# (part1)normal image with steps below
kubectl apply -f first.yaml
kubectl logs test-container
# should be noticed 1777 on /tmp
# clean up
kubectl delete pod test-container

# (part2)pulsar-manager image with strange behavior
kubectl apply -f second.yaml
kubectl logs test-container
# why it become 1755(rwxr-xr-xt) on /tmp ?????
# clean up
kubectl delete pod test-container
```

![Untitled](https://user-images.githubusercontent.com/5139583/76145714-f0533f00-60c6-11ea-806d-a463505a8cf9.png)

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.