Linux卷没有权限,docker 挂在外部卷报无权限处理

Can not write to /var/jenkins_home/copy_reference_file.log. Wrong volume permissions?

touch: cannot touch ‘/var/jenkins_home/copy_reference_file.log’: Permission denied

执行如下命令

docker@default:~$ docker run -ti --rm --entrypoint="/bin/bash" jenkins -c "whoami && id"

jenkins

uid=1000(jenkins) gid=1000(jenkins) groups=1000(jenkins)

docker@default:~$ docker run -ti --rm --entrypoint="/bin/bash" jenkins -c "ls -la /var/jenkins_home"

total 20

drwxr-xr-x  2 jenkins jenkins 4096 Jun  5 08:39 .

drwxr-xr-x 28 root    root    4096 May 24 16:43 ..

-rw-r--r--  1 jenkins jenkins  220 Nov 12  2014 .bash_logout

-rw-r--r--  1 jenkins jenkins 3515 Nov 12  2014 .bashrc

-rw-r--r--  1 jenkins jenkins  675 Nov 12  2014 .profile

而当映射本地数据卷时，/var/jenkins_home目录的拥有者变成了root用户

docker run -ti --rm -v $(pwd)/data:/var/jenkins_home --entrypoint="/bin/bash" jenkins -c "ls -la /var/jenkins_home"

total 4

drwxr-sr-x  2 root staff   40 Jun  5 08:32 .

drwxr-xr-x 28 root root  4096 May 24 16:43 ..

这就解释了为什么当"jenkins"用户的进程访问"/var/jenkins_home"目录时，会出现 Permission denied 的问题

我们再检查一下宿主机上的数据卷目录，当前路径下"data"目录的拥有者是"root"，这是因为这个目录是Docker进程缺省创建出来的。

docker@default:~$ ls -la data

total 0

drwxr-sr-x    2 root     staff           40 Jun  5 08:32 ./

drwxr-sr-x    5 docker   staff          160 Jun  5 08:32 ../

发现问题之后，相应的解决方法也很简单：把当前目录的拥有者赋值给uid 1000，再启动"jenkins"容器就一切正常了。

sudo chown -R 1000 data

docker start jenkins

如果还不行(重点！！！！！！！)

如果按照上面做还是出现Permission denied错误，那么可以检查一下selinux状态，开启的情况下会导致一些服务安装、使用不成功。

查看selinux状态，

[root@localhost ~]# sestatus

SELinux status:                 enabled

SELinuxfs mount:                /sys/fs/selinux

SELinux root directory:         /etc/selinux

Loaded policy name:             targeted

Current mode:                   enforcing

Mode from config file:          enforcing

Policy MLS status:              enabled

Policy deny_unknown status:     allowed

Max kernel policy version:      28

临时关闭，

[root@localhost ~]# setenforce 0

1

永久关闭,可以修改配置文件/etc/selinux/config,将其中SELINUX设置为disabled，如下，

[root@localhost ~]# cat /etc/selinux/config

# This file controls the state of SELinux on the system.

# SELINUX= can take one of these three values:

#     enforcing - SELinux security policy is enforced.

#     permissive - SELinux prints warnings instead of enforcing.

#     disabled - No SELinux policy is loaded.

#SELINUX=enforcing

SELINUX=disabled

# SELINUXTYPE= can take one of three two values:

#     targeted - Targeted processes are protected,

#     minimum - Modification of targeted policy. Only selected processes are protected.

#     mls - Multi Level Security protection.

SELINUXTYPE=targeted

[root@rdo ~]# sestatus

SELinux status:                 disabled