cockroachdb / cockroachdb/cockroach
mkfifo fail when running as non root user
- Dominant language
- Go
- Stars
- 32.5k
- Forks
- 4.1k
- PR merge metrics
- PR metrics pending
Description
**Describe the problem**
When running crdb docker container with the option `user: 1000:1000` the container fails with the following log error:
```
mkfifo: cannot create fifo 'server_fifo': Permission denied
```
which i think originates from here:
https://github.com/cockroachdb/cockroach/blob/6d362070be19565f0252af57296dfe8e8bbb8365/build/deploy/cockroach.sh#L134
---
**To Reproduce**
1. Create dirs `mycrdb/certs` and `mycrdb/data` (owned by user 1000, and default perms 755) to avoid "could not write CAs" cockroach error when initializing.
2. Buid the container using this compose:
```yaml
mycrdb:
image: cockroachdb/cockroach:latest
container_name: mycrdb
command: "start-single-node --advertise-addr mycrdb"
user: 1000:1000
ports:
- "9090:8080"
- "26257:26257"
networks:
- mynetwork
volumes:
- ./mycrdb/certs:/cockroach/certs:rw
- ./mycrdb/data:/cockroach/cockroach-data:rw
```
3. See container logs.
```
docker logs -f mycrdb
```
---
**Expected behavior**
The cockroachdb container gets generated without errors, and the generated content in the bind volumes are owned by the user with id 1000 instead of root.
---
**Additional data / screenshots**
Related to:
- https://github.com/cockroachdb/docs/issues/8416
- https://github.com/cockroachdb/docs/issues/7697
---
**Environment:**
- CockroachDB version v24.1.0
- Server OS: Linux/Ubuntu
**Additional context**
What was the impact?
Can't proceed with container hardening.
Jira issue: CRDB-39655
Contributor guide
Assessment
This issue has not been assessed yet.