permissions for CSI volume mounted to `exec` driver don't allow task's user
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Nomad version
> Nomad v1.4.3 (f464aca721d222ae9c1f3df643b3c3aaa20e2da7)
### Operating system and Environment details
Fedora 36 (Server)
### Issue
Using CSI volume mounted in the task started using `exec` driver is impossible due to mount point being owned by root with 0755 permissions.
### Reproduction steps
* Ceph 3 node cluster
* Nomad configured using https://docs.ceph.com/en/latest/rbd/rbd-nomad/#create-a-pool
* Volume created with RW permission as "file-system"
* Job with `exec` driver that mounts above volume with `read_only = false`
#### Expected Result
* Mount point is owned by the same user as the one inside the namespace (default `nobody`)
* OR mount point is otherwise made write-able (i.e. setting permissions)
#### Actual Result
* Mount point is owned by root and uses 0755 permissions. Hence default `nobody` user can't use it.
#### Note
I'd consider this a bug since there is no clear way to use CSI volumes with `exec` driver other than running process as `root`.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with Nomad's exec driver and CSI volume mount handling, then reproduce the Fedora 36 setup with a non-root task user and a writable Ceph-backed volume. Trace where the mount point ownership and 0755 permissions are established. Done means the task user can write to a read-write CSI volume without requiring root, with regression coverage if the relevant tests are found.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100