Binding volume with 'withFileSystemBind' -> Permission Denied

[naturzukunft]

This is the discussion to find a solution for the problem: https://stackoverflow.com/questions/68653002/binding-volume-with-withfilesystembind-permission-denied

[kiview]

Hey @naturzukunft, thanks for recreating here.

As written in the SO comment, let's work backward from a working Docker CLI call. Your Testcontainers code represents this Docker CLI command, which already fails:

docker run -ti --rm -v /tmp/dockerVolumes/:/mnt/spring/ -e SPRING_PROFILES_ACTIVE=test registry.gitlab.com/linkedopenactors/loa-suite:feature-testcontainer

What is the working Docker command? Once we know it, we can transform it into corresponding Testcontainers code.

[naturzukunft]

I try to get some info from my colleagues, that are more Docker guys as me ,-)

[naturzukunft]

if i create a docker volume on my local machine with: docker volume create --name=rdf4jRepos
then the following folder is created: /home/xyz/tmp/rdf4jRepos
After that i'm able to start with : docker run -ti --rm -v /home/xyz/tmp/rdf4jRepos:/mnt/spring/ -e SPRING_PROFILES_ACTIVE=test registry.gitlab.com/linkedopenactors/loa-suite:feature-testcontainer

Is there a way to create a volume using testcontainers?

[kiview]

It is already config specific, that your volume ends up in /home/xyz/tmp/rdf4jRepos. You are creating a Docker volume object, but then do bind mound from the host, more or less accidentally at the location where at your config the volume ends up (it could be on another machine for all that Docker cares of).

Instead you should mount the volume:

docker run -ti --rm -v rdf4jRepos:/mnt/spring/ -e SPRING_PROFILES_ACTIVE=test registry.gitlab.com/linkedopenactors/loa-suite:feature-testcontainer

[cmllr]

I did some test together with @naturzukunft and we found out following:

Docker-Managed volumes:

(Basically forcing docker to create a volume on the fly)

Docker commandline: docker run -ti --rm -v somegivennamebutnotafolder:/mnt/spring/ -e SPRING_PROFILES_ACTIVE=test registry.gitlab.com/linkedopenactors/loa-suite:feature-testcontainer

I can see that the mount on /mnt/spring is owned by the user spring as defined in the Dockerfile. The container runs fine.

/ $ ls /mnt/spring -lah
total 16K
drwxr-xr-x    4 spring   spring      4.0K Oct  7 13:12 .

Mount folder directly

Docker commandline: docker run -ti --rm -v /path/to/my/folder:/mnt/spring/ -e SPRING_PROFILES_ACTIVE=test registry.gitlab.com/linkedopenactors/loa-suite:feature-testcontainer

The container will fail on runtime as it cannot write the data inside /mnt/spring/, as the folder is owned by root.

/ $ ls /mnt/spring -lah
total 16K
drwxr-xr-x    1 root     root          4096 Sep 16 14:25 .

Remarks

For both file listings I overwrote the entrypoint with --entrypoint=/bin/busybox to get a shell into the container.

So as it looks like (correct my if wrong), testcontainers is using the second way to directly mount the folders using withFileSystemBind, which will subsequently fail because of the permissions. In theory you can workaround that by persisting and setting the gid/uid per hand, but in a test environment that's not really an option as the gid/uid from the container might be changing.

Edit for the remarks: Using Docker Desktop on Windows with Docker using the WSL2 backend.

[kiview]

Using withFileSystemBind is binding from the host. If you want to use a volume, you have to use withVolumesFrom.

If you bind from the host on CI systems that use docker-wormhole pattern, you will have a sibling container and bind relative to host from the host, which is probably not what you want.

[naturzukunft]

using a relative path for GenericContainer also ends in a directory that is owned by root.

public GenericContainer ap = new GenericContainer(DockerImageName.parse("xyz"))
                                        .withExposedPorts(AP_PORT)
                                        .withFileSystemBind("target/dockerVolumes/", "/mnt/spring/", BindMode.READ_WRITE)
                                        .withLogConsumer(new Slf4jLogConsumer(log))
                                        .waitingFor(Wait.forHttp("/swagger-ui.html"));

The folder is created in the project directory: .../target

$ ls -lsh
4,0K drwxr-xr-x 2 root  root  4,0K ott  7 16:05 dockerVolumes

test was executed in springToolSuite, which was started by a not root user.

[kiview]

I have a slight feeling we are working around unnecessary problems as long as we don't understand your original use case. Why do you need files from the host in the container in the first place? Or the other way around, do you need files from the container on the host?

The easiest way to get files into the container is using copyFileToContainer.

[jglick]

do you need files from the container on the host?

See #1006.

[adispennette]

I am having a similar issue, I need a config to be present in the ci runner before the test container starts up, copyFileToContainer needs the test container to be started already. I don't have control over the ci runner so getting the config into the test container has become an impossibility.

[kiview]

@adispennette You can use withCopyFileToContainer, which works during definition of the container object, before starting the container.

[adispennette]

Sorry @kiview, you're right. I think I was thinking of a different call I had tried. I have been fighting gitlab and testcontainers for a while now and I am not winning. I have tried binding the to the file system and that gives and error related to binding a folder to a file, I have tried copy to container, copy from classpath and a few other things and the testcontainer will not start up in gitlab. locally it runs like a champ, but gitlib just fails to start up the testcontainer.

[knighthedspi]

I have faced the similar issue. Like @kiview said, I managed to make it work by using the copyFileFromContainer after finishing testing.