Skip to content

get '/var/run/postgresql': Operation not permitted with arbitrary --user #853

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
ise-tang opened this issue Jun 3, 2021 · 1 comment
Closed

get '/var/run/postgresql': Operation not permitted with arbitrary --user #853

ise-tang opened this issue Jun 3, 2021 · 1 comment
Labels
question Usability question, not directly related to an error with the image

Comments

@ise-tang
Copy link

ise-tang commented Jun 3, 2021

Hi.

I try to run the postgres container with an arbitrary user.
When that, I get chmod: changing permissions of '/var/run/postgresql': Operation not permitted
Is that right working? If not, What Can I do to fix?

Host: macOS 11.4
Vagrant : 2.2.16
VM box: ubuntu/groovy64

I do below

vagrant@lvh:~$ docker volume create pgdata
pgdata
vagrant@lvh:~$ docker run -it --rm -v pgdata:/var/lib/postgresql/data -e POSTGRES_PASSWORD=mysecretpassword postgres
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
...

vagrant@lvh:~$ docker run -it --rm -v pgdata:/var/lib/postgresql/data bash chown -R 1000:1000 /var/lib/postgresql/data
vagrant@lvh:~$ docker run -it --rm --user 1000:1000 -v pgdata:/var/lib/postgresql/data postgres
chmod: changing permissions of '/var/run/postgresql': Operation not permitted # <== Is this right ?

PostgreSQL Database directory appears to contain a database; Skipping initialization

2021-06-03 00:26:42.378 UTC [1] LOG:  starting PostgreSQL 13.3 (Debian 13.3-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
2021-06-03 00:26:42.379 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
@wglambert wglambert added the question Usability question, not directly related to an error with the image label Jun 3, 2021
@wglambert
Copy link

Yeah it worked correctly for you, that chmod error is non-failing #804

I've done methods 2&3 from https://github.com/docker-library/docs/tree/master/postgres#arbitrary---user-notes shown below, and these both worked fine

Method 3 with chown inbetween 
$ docker volume create pgdata
pgdata

$ docker run -it --rm -v pgdata:/var/lib/postgresql/data -e POSTGRES_PASSWORD=mysecretpassword postgres
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting dynamic shared memory implementation ... posix
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting default time zone ... Etc/UTC
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok

initdb: warning: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.

Success. You can now start the database server using:

    pg_ctl -D /var/lib/postgresql/data -l logfile start

waiting for server to start....2021-06-03 14:39:55.671 UTC [47] LOG:  starting PostgreSQL 13.3 (Debian 13.3-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
2021-06-03 14:39:55.672 UTC [47] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2021-06-03 14:39:55.678 UTC [48] LOG:  database system was shut down at 2021-06-03 14:39:55 UTC
2021-06-03 14:39:55.682 UTC [47] LOG:  database system is ready to accept connections
 done
server started

/usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*

2021-06-03 14:39:55.858 UTC [47] LOG:  received fast shutdown request
waiting for server to shut down...2021-06-03 14:39:55.860 UTC [47] LOG:  aborting any active transactions
.2021-06-03 14:39:55.863 UTC [47] LOG:  background worker "logical replication launcher" (PID 54) exited with exit code 1
2021-06-03 14:39:55.863 UTC [49] LOG:  shutting down
2021-06-03 14:39:55.875 UTC [47] LOG:  database system is shut down
 done
server stopped

PostgreSQL init process complete; ready for start up.

2021-06-03 14:39:56.002 UTC [1] LOG:  starting PostgreSQL 13.3 (Debian 13.3-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
2021-06-03 14:39:56.007 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
2021-06-03 14:39:56.007 UTC [1] LOG:  listening on IPv6 address "::", port 5432
2021-06-03 14:39:56.010 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2021-06-03 14:39:56.015 UTC [66] LOG:  database system was shut down at 2021-06-03 14:39:55 UTC
2021-06-03 14:39:56.020 UTC [1] LOG:  database system is ready to accept connections
^C2021-06-03 14:39:59.753 UTC [1] LOG:  received fast shutdown request
2021-06-03 14:39:59.754 UTC [1] LOG:  aborting any active transactions
2021-06-03 14:39:59.758 UTC [1] LOG:  background worker "logical replication launcher" (PID 72) exited with exit code 1
2021-06-03 14:39:59.758 UTC [67] LOG:  shutting down
2021-06-03 14:39:59.771 UTC [1] LOG:  database system is shut down

$ docker run -it --rm -v pgdata:/var/lib/postgresql/data bash chown -R 1000:1000 /var/lib/postgresql/dataUnable to find image 'bash:latest' locally
latest: Pulling from library/bash
339de151aab4: Pull complete 
ebfc2c53be8a: Pull complete 
9b416d32a3fe: Pull complete 
Digest: sha256:86861c0d08be2e91f2c1f5af12b17724161cccd278b0b620b68c68b1926d105d
Status: Downloaded newer image for bash:latest

$ docker run -it --rm --user 1000:1000 -v pgdata:/var/lib/postgresql/data postgres
chmod: changing permissions of '/var/run/postgresql': Operation not permitted

PostgreSQL Database directory appears to contain a database; Skipping initialization

2021-06-03 14:42:25.221 UTC [1] LOG:  starting PostgreSQL 13.3 (Debian 13.3-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
2021-06-03 14:42:25.226 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
2021-06-03 14:42:25.226 UTC [1] LOG:  listening on IPv6 address "::", port 5432
2021-06-03 14:42:25.229 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2021-06-03 14:42:25.236 UTC [13] LOG:  database system was shut down at 2021-06-03 14:39:59 UTC
2021-06-03 14:42:25.248 UTC [1] LOG:  database system is ready to accept connections
Method 2 with mounted /etc/passwd 
$ mkdir pgdata

$ chown 1000:1000 pgdata

$ docker run -it --rm --user 1000:1000 -e POSTGRES_PASSWORD=pass -v "$PWD"/passwd:/etc/passwd -v "$PWD"/pgdata:/var/lib/postgresql/data postgres
chmod: changing permissions of '/var/run/postgresql': Operation not permitted
The files belonging to this database system will be owned by user "testuser".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are disabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
creating subdirectories ... ok
selecting dynamic shared memory implementation ... posix
selecting default max_connections ... 100
selecting default shared_buffers ... 128MB
selecting default time zone ... Etc/UTC
creating configuration files ... ok
running bootstrap script ... ok
performing post-bootstrap initialization ... ok
syncing data to disk ... ok

initdb: warning: enabling "trust" authentication for local connections
You can change this by editing pg_hba.conf or using the option -A, or
--auth-local and --auth-host, the next time you run initdb.

Success. You can now start the database server using:

    pg_ctl -D /var/lib/postgresql/data -l logfile start

waiting for server to start....2021-06-03 14:39:17.473 UTC [34] LOG:  starting PostgreSQL 13.3 (Debian 13.3-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
2021-06-03 14:39:17.489 UTC [34] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2021-06-03 14:39:17.542 UTC [35] LOG:  database system was shut down at 2021-06-03 14:39:17 UTC
2021-06-03 14:39:17.547 UTC [34] LOG:  database system is ready to accept connections
 done
server started

/usr/local/bin/docker-entrypoint.sh: ignoring /docker-entrypoint-initdb.d/*

waiting for server to shut down....2021-06-03 14:39:17.767 UTC [34] LOG:  received fast shutdown request
2021-06-03 14:39:17.768 UTC [34] LOG:  aborting any active transactions
2021-06-03 14:39:17.770 UTC [34] LOG:  background worker "logical replication launcher" (PID 41) exited with exit code 1
2021-06-03 14:39:17.775 UTC [36] LOG:  shutting down
2021-06-03 14:39:17.790 UTC [34] LOG:  database system is shut down
 done
server stopped

PostgreSQL init process complete; ready for start up.

2021-06-03 14:39:17.895 UTC [1] LOG:  starting PostgreSQL 13.3 (Debian 13.3-1.pgdg100+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 8.3.0-6) 8.3.0, 64-bit
2021-06-03 14:39:17.986 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
2021-06-03 14:39:17.987 UTC [1] LOG:  listening on IPv6 address "::", port 5432
2021-06-03 14:39:17.989 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
2021-06-03 14:39:17.993 UTC [53] LOG:  database system was shut down at 2021-06-03 14:39:17 UTC
2021-06-03 14:39:17.999 UTC [1] LOG:  database system is ready to accept connections

@wglambert wglambert mentioned this issue Jan 3, 2022
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
question Usability question, not directly related to an error with the image
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@ise-tang @wglambert