Docker persisted volum has no permissions (Apache Solr)

问题

My docker-compose.yml:

solr:
    image: solr:8.6.2
    container_name: myproject-solr
    ports:
     - "8983:8983"
    volumes:
      - ./data/solr:/var/solr/data
    networks:
      static-network:
        ipv4_address: 172.20.1.42

After bringing up the docker with docker-compose up -d --build, the solr container is down and the log (docker logs myproject-solr) shows this:

Copying solr.xml
cp: cannot create regular file '/var/solr/data/solr.xml': Permission denied

I've noticed that if I give full permissions on my machine to the data directory sudo chmod 777 ./data/solr/ -R and I run the Docker again, everything is fine.

I guess the issue comes when the solr user is not my machine, because Docker creates the data/solr folder with root:root. Having my ./data folder gitignored, I cannot manage these folder permissions.

I'd like to know a workaround to manage permissions properly with the purpose of persisting data

回答1:

It's a known "issue" with docker-compose: all files created by Docker engine are owned by root:root. Usually it's solved in one of the two ways:

1. Create the volume in advance. In your case, you can create the ./data/solr directory in advance, with appropriate permissions. You might make it accessible to anyone, or, better, change its owner to the solr user. The solr user and group ids are hardcoded inside the solr image: 8983 (Dockerfile.template)

mkdir -p ./data/solr
sudo chown 8983:8983 ./data/solr

2. If you want to avoid running additional commands before docker-compose, you can create additional container which will fix the permissions:

version: "3"

services:

  initializer:
    image: alpine
    container_name: solr-initializer
    restart: "no"
    entrypoint: |
      /bin/sh -c "chown 8983:8983 /solr"
    volumes:
      - ./data/solr:/solr
    
  solr:
    depends_on: 
      - initializer
    image: solr:8.6.2
    container_name: myproject-solr
    ports:
     - "8983:8983"
    volumes:
      - ./data/solr:/var/solr/data  
    networks:
      static-network:
        ipv4_address: 172.20.1.42

回答2:

Set with a Dockerfile

It's possibly not exactly what you wanted as the files aren't persisted when rebuilding the container, but it solves the 'rights' problem. Copy the files over and chown them with a Dockerfile:

FROM solr:8.7.0
COPY --chown=solr ./data /var/solr/data

This is more useful if you're trying to initialise a single core:

FROM solr:8.7.0
COPY --chown=solr ./core /var/solr/data/someCollection

It also has the advantage that you can create an image for reuse.

With a named volume

For persistence, you can also create a volume (in this case core) and copy the contents of a directory (also called core here), assigning the rights to the files on the way:

docker container create --name temp -v core:/data tianon/true || exit $?
tar -cf - --directory core --owner 8983 --group 8983 . | docker cp - temp:/data
docker rm temp

This was adapted from these answers:

• https://github.com/moby/moby/issues/25245#issuecomment-365980572
• https://stackoverflow.com/a/52446394

Then you can mount the named volume in your Docker Compose file:

version: '3'
services:
  solr:
    image: solr:8.7.0
    networks:
      - internal
    ports:
      - 8983:8983
    volumes:
      - core:/var/solr/data/someCollection

volumes:
  core:
    external: true

This solution persists the data without overriding the data on the host. And it doesn't need the extra build step. And can obviously be adapted for mounting the entire /var/solr/data folder.

It doesn't seem to matter that the mounted volume/directory doesn't have the correct rights (/var/solr/data/someCollection has owner root:root).

来源：https://stackoverflow.com/questions/63993993/docker-persisted-volum-has-no-permissions-apache-solr