Ipfs in container creates files with root as owner #8725
Comments
akhilman
added
kind/bug
|
Thank you for submitting your first issue to this repository! A maintainer will be here shortly to triage and review.
Finally, remember to use https://discuss.ipfs.io if you just need general support. |
|
podman top output: |
|
I will reopen this issue if get more information when exactly ipfs creates files owned by root. |
|
I have the same issue (up to now only with repo.lock) running ipfs kubo in container with version 0.15.0. |
I had solved this issue by adding |
|
Reopening this issue because it affects not only my. |
|
Thank your for your answers! Really appreciated. I get why the fix might (not suggesting that it does not, but I do not understand the exact why) work, since I found this before I found this issue https://github.com/ipfs/kubo/blob/master/bin/container_daemon#L7-L13 and I have been of the opinion that it should work. |
OK. This is strange. Now I also don't understand why there are files owned by root. |
|
And btw.: Not setting user in Dockerfile, but changing it in the entrypoint script seems unusual. However, one benefit is that the cli process is still able to read files not belonging to the ipfs user. So, if I use |
|
This also affected me. Last week node created a file owned by root, which was As of now my docker-compose.yml entry fro this service is as follows ipfsnode:
restart: always
image: ipfs/go-ipfs:v0.14.0
privileged: true
volumes:
- "/hdd/ipfs2/ipfs_staging:/export"
- "/hdd/ipfs2/ipfs_data:/data/ipfs"
healthcheck:
interval: 5s
ports:
- "0.0.0.0:5021:5001"
- "0.0.0.0:8080:8080"Hope to see a solution soon, thanks |
|
Hi, I'm having still the same issue with the current version. I'm running the Kubo container through docker compose with a non-root user but it still create a ../home/ipfs directory and files owned by root. Any advise for these folders to be created with the user I'm executing docker compose as the owner? |
|
I'm just adding my +1 here. I'm running a Kubo container on AWS ECS with Fargate and occasionally (not always) get the error: The logs: This happens in ~5-10% of the Kubo boots. Setting the |
|
For everyone who's watching this. We believe to have fixed the issue. The problem seems to have been that the health check command ran before the daemon process started. Commonly, the health check is run as root and initializes the repository. The daemon, which is run as a non-privileged user by default, doesn't have permission to interact with that. This was fixed in #9992 by passing a flag to the health check command that prevents it from initializing the repository. |
|
I still have the issue. I've been running ipfs in a container on AWS Fargate. ipfs version 0.25.0 Error: lock /data/ipfs/repo.lock: permission denied I'm also trying to delete the repo.lock when the container starts but I struggle to extend the ENTRYPOINT and CMD to run a custom script that deletes this file. I can't login into the container to delete the file by hand. Any idea how I can automatically delete this file as the root user? |
|
I've made a fix for this |
Checklist
Installation method
third-party binary
Version
Config
{ "API": { "HTTPHeaders": { "Access-Control-Allow-Methods": [ "PUT", "POST" ], "Access-Control-Allow-Origin": [ "http://192.168.16.90:5001", "http://192.168.16.90:5080", "http://servak.local:5001", "http://servak.local:5080" ] } }, "Addresses": { "API": "/ip4/0.0.0.0/tcp/5001", "Announce": [], "Gateway": "/ip4/0.0.0.0/tcp/8080", "NoAnnounce": [], "Swarm": [ "/ip4/0.0.0.0/tcp/4001", "/ip4/0.0.0.0/tcp/4002/ws", "/ip6/::/tcp/4001", "/ip4/0.0.0.0/udp/4001/quic", "/ip6/::/udp/4001/quic" ] }, "AutoNAT": {}, "Bootstrap": [ "/dnsaddr/bootstrap.libp2p.io/p2p/QmNnooDu7bfjPFoTZYxMNLWUQJyrVwtbZg5gBMjTezGAJN", "/dnsaddr/bootstrap.libp2p.io/p2p/QmQCU2EcMqAqQPR2i9bChDtGNJchTbq5TbXJJ16u19uLTa", "/dnsaddr/bootstrap.libp2p.io/p2p/QmbLHAnMoJPWSCR5Zhtx6BHJX9KiKNN6tpvbUcqanj75Nb", "/dnsaddr/bootstrap.libp2p.io/p2p/QmcZf59bWwK5XFi76CZX8cbJ4BhTzzA3gU1ZjYZcYW3dwt", "/ip4/104.131.131.82/tcp/4001/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ", "/ip4/104.131.131.82/udp/4001/quic/p2p/QmaCpDMGvV2BGHeYERUEnRQAwe3N8SzbUtfsmvsqQLuvuJ" ], "DNS": { "Resolvers": null }, "Datastore": { "BloomFilterSize": 0, "GCPeriod": "1h", "HashOnRead": false, "Spec": { "mounts": [ { "child": { "path": "blocks", "shardFunc": "/repo/flatfs/shard/v1/next-to-last/2", "sync": true, "type": "flatfs" }, "mountpoint": "/blocks", "prefix": "flatfs.datastore", "type": "measure" }, { "child": { "compression": "none", "path": "datastore", "type": "levelds" }, "mountpoint": "/", "prefix": "leveldb.datastore", "type": "measure" } ], "type": "mount" }, "StorageGCWatermark": 90, "StorageMax": "90GB" }, "Discovery": { "MDNS": { "Enabled": true, "Interval": 10 } }, "Experimental": { "AcceleratedDHTClient": false, "FilestoreEnabled": false, "GraphsyncEnabled": false, "Libp2pStreamMounting": false, "P2pHttpProxy": false, "ShardingEnabled": false, "StrategicProviding": false, "UrlstoreEnabled": false }, "Gateway": { "APICommands": [], "HTTPHeaders": { "Access-Control-Allow-Headers": [ "X-Requested-With", "Range", "User-Agent" ], "Access-Control-Allow-Methods": [ "GET" ], "Access-Control-Allow-Origin": [ "*" ] }, "NoDNSLink": false, "NoFetch": false, "PathPrefixes": [], "PublicGateways": null, "RootRedirect": "", "Writable": false }, "Identity": { "PeerID": "12D3KooWQxEEfUh5HBgjA8bikndUFs9JnA62qAF7w7wvs4wYrtXP" }, "Ipns": { "RecordLifetime": "", "RepublishPeriod": "", "ResolveCacheSize": 128 }, "Migration": { "DownloadSources": null, "Keep": "" }, "Mounts": { "FuseAllowOther": false, "IPFS": "/ipfs", "IPNS": "/ipns" }, "Peering": { "Peers": null }, "Pinning": { "RemoteServices": {} }, "Plugins": { "Plugins": null }, "Provider": { "Strategy": "" }, "Pubsub": { "DisableSigning": false, "Router": "" }, "Reprovider": { "Interval": "12h", "Strategy": "all" }, "Routing": { "Type": "dht" }, "Swarm": { "AddrFilters": null, "AutoRelay": true, "ConnMgr": { "GracePeriod": "20s", "HighWater": 600, "LowWater": 300, "Type": "basic" }, "DisableBandwidthMetrics": false, "DisableNatPortMap": false, "Transports": { "Multiplexers": {}, "Network": {}, "Security": {} } } }Description
Since the go-ipfs v0.11 container from docker.io/ipfs/go-ipfs, files with root as owner are sometimes created and then ipfs cannot access these files.
Previously I had this problem with
repo.lockand now with the database file.go-ipfs v0.10 and earlier did not have this problem.
When this problem first appeared, after updating to v0.11, I rolled back to v0.10 and the problem went away.
and root owned file itself
Repo.lock created with root as owner:
The text was updated successfully, but these errors were encountered: