cockroachdb / cockroachdb/cockroach

mkfifo fail when running as non root user

Open
#125,906 3 comments 0 reactions 0 assignees View on GitHub
branch-master C-bug O-community T-dev-inf X-blathers-triaged
Dominant language
Go
Stars
32.5k
Forks
4.1k
PR merge metrics
PR metrics pending

Description

**Describe the problem**

When running crdb docker container with the option `user: 1000:1000` the container fails with the following log error:
```
mkfifo: cannot create fifo 'server_fifo': Permission denied
```
which i think originates from here:
https://github.com/cockroachdb/cockroach/blob/6d362070be19565f0252af57296dfe8e8bbb8365/build/deploy/cockroach.sh#L134

---

**To Reproduce**
1. Create dirs `mycrdb/certs` and `mycrdb/data` (owned by user 1000, and default perms 755) to avoid "could not write CAs" cockroach error when initializing.
2. Buid the container using this compose:
```yaml
mycrdb:
image: cockroachdb/cockroach:latest
container_name: mycrdb
command: "start-single-node --advertise-addr mycrdb"
user: 1000:1000
ports:
- "9090:8080"
- "26257:26257"
networks:
- mynetwork
volumes:
- ./mycrdb/certs:/cockroach/certs:rw
- ./mycrdb/data:/cockroach/cockroach-data:rw
```
3. See container logs.
```
docker logs -f mycrdb
```

---

**Expected behavior**

The cockroachdb container gets generated without errors, and the generated content in the bind volumes are owned by the user with id 1000 instead of root.

---

**Additional data / screenshots**

Related to:
- https://github.com/cockroachdb/docs/issues/8416
- https://github.com/cockroachdb/docs/issues/7697

---

**Environment:**
- CockroachDB version v24.1.0
- Server OS: Linux/Ubuntu

**Additional context**
What was the impact?
Can't proceed with container hardening.

Jira issue: CRDB-39655

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.