hashicorp / hashicorp/nomad

option to manage volume permissions

Open
#8,892 18 comments 83 reactions 0 assignees View on GitHub
hcc/jira stage/needs-discussion theme/storage type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

Hello,

In Kubernetes/Openshift, when you mount a volume (through CSI or otherwise), you can configure its security context, and there determine, among other things, what Linux user and group the volume will be mounted as:

> By default, Kubernetes recursively changes ownership and permissions for the contents of each volume to match the fsGroup specified in a Pod's securityContext when that volume is mounted.

Is there anything similar in Nomad? As far as I can tell, the only alternative is something like running the following pretask to ensure the configuration is what you want:
```hcl
task "prep-disk" {
driver = "docker"
volume_mount {
volume = "nexus-volume"
destination = "/nexus-data/"
read_only = false
}
config {
image = "busybox:latest"
command = "sh"
args = ["-c", "chown -R 200:200 /nexus-data/"]
}
resources {
cpu = 200
memory = 128
}

lifecycle {
hook = "prestart"
sidecar = false
}
}
```

If this is the recommended way, is there any way it could be added as an example in the documentation? It would appear to me to be a relatively common use case. Thanks!

Contributor guide

No contributing guide indexed for this repository

Research direction

The payload names no repository files or tests. Start by reviewing Nomad's volume_mount configuration, the Docker driver, and the prestart prep-disk example; determine the supported approach for volume ownership and permissions, then document it or specify the missing option, with the resulting user and group ownership as the completion check.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, kubernetes, linux
Domain
devops, infrastructure, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.