Jenkins wrong volume permissions

Question

I have a virtual machine hosting Oracle Linux where I've installed Docker and created containers using a docker-compose file. I placed the jenkins volume under a shared folder but when starting the docker-compose up I got the following error for Jenkins :

jenkins | touch: cannot touch ‘/var/jenkins_home/copy_reference_file.log’: Permission denied jenkins | Can not write to /var/jenkins_home/copy_reference_file.log. Wrong volume permissions? jenkins exited with code 1

Here's the volumes declaration

  volumes:
    - "/media/sf_devops-workspaces/dev-tools/continuous-integration/jenkins:/var/jenkins_home"

Soke

Put your entire docker-compose.yml file please – Rope

Quick fix: find out the numeric user ID of the user running Jenkins inside the container and change the owner of the host directory to this user ID. – Crim

some more ideas: #23544782 – Crim

@Rope hastebin.com/bucunekelo.http – Soke

@Crim how do I do that ? I'm not using dockerfiles only a docker compose ! the container can't start because of that tho so I can't access it and make commands.. – Soke

Answer 1

The problem is, that your user in the container has different userid:groupid as the user on the host.

you have two possibilities:

1. You can ensure that the user in the container has the same userid:groupid like the user on the host, which has access to the mounted volume. For this you have to adjust the user in the Dockerfile. Create a user in the dockerfile with the same userid:groupid and then switch to this user https://docs.docker.com/engine/reference/builder/#user

2. You can ensure that the user on the host has the same userid:groupid like the user in the container. For this, enter the container with docker exec -it <container-name> bash and show the user id id -u <username> group id id -G <username>. Change the permissions of the mounted volume to this userid:groupid.

Piccard

I can't start the container thus I can't access it and do the 2nd solution.. for the first one can you add some details about it ? – Soke

For the first solution you have to build the docker image. Means you need the Dockerfile and the artifacts which are copied into the Dockerfile. If you have this, you can build the image and also change the Dockerfile. – Piccard

@TaoufikJabbari why can't you start the container? In fact you need only the image, you can start it even on another machine. You use another start command so this should work as long as there is bash in the image. – Crim

@Crim did I miss something or an image is like a class and the instance are the containers? because If I run a new container it won't impact the one define in the compose because they're two different instances.. – Soke

@TaoufikJabbari No that's correct, but just to find out the numeric user id you don't need the exact same container (this is "class information"). – Crim

Answer 2

The easy fix it to use the -u parameter. Keep in mind this will run as a root user (uid=0)

docker run -u 0 -d -p 8080:8080 -p 50000:50000 -v /data/jenkins:/var/jenkins_home jenkins/jenkins:lts

Luhe

Answer 3

As haschibaschi stated your user in the container has different userid:groupid than the user on the host.

To get around this is to start the container without the (problematic) volume mapping, then run bash on the container:

docker run -p 8080:8080 -p 50000:50000 -it jenkins bin/bash

Once inside the container's shell run the id command and you'll get results like:

uid=1000(jenkins) gid=1000(jenkins) groups=1000(jenkins)

Exit the container, go to the folder you are trying to map and run:

chown -R 1000:1000 .

With the permissions now matching, you should be able to run the original docker command with the volume mapping.

Nerissanerita

how to do this in windows ? – Emunctory

Doesn't work on Mac either. This worked brilliantly on an Alpine Linux host, however, didn't quite work on the Mac M1. I had to do chmod 777 (not the best way) to just get it working. – Inchworm

Answer 4

You may be under SELinux. Running the container as privileged solved the issue for me:

sudo docker run --privileged -p 8080:8080 -p 50000:50000 -v /data/jenkins:/var/jenkins_home jenkins/jenkins:lts

From https://docs.docker.com/engine/reference/commandline/run/#full-container-capabilities---privileged:

The --privileged flag gives all capabilities to the container, and it also lifts all the limitations enforced by the device cgroup controller. In other words, the container can then do almost everything that the host can do. This flag exists to allow special use-cases, like running Docker within Docker.

Interlineate

Worked on RHEL 7.9 – Bound

Answer 5

As an update of @Kiem's response, using $UID to ensure container uses the same user id as the host, you can do this:

docker run -u $UID -d -p 8080:8080 -p 50000:50000 -v /data/jenkins:/var/jenkins_home jenkins/jenkins:lts

Ecclesiasticus

Have you actually used this solution? I tried this in jenkins and got the error: groovy.lang.MissingPropertyException: No such property: UID for class: groovy.lang.Binding – Overhang

Answer 6

I had a similar issue with Minikube/Kubernetes just added

securityContext:
  fsGroup: 1000
  runAsUser: 0

under deployment -> spec -> template -> spec

Conversazione

Answer 7

Its good to use a docker-compose.yml.

Init you should give priviledged:true & user:root as follows.

version: '3'
services:
  jenkins:
    container_name: jenkins
    image: jenkins/jenkins:lts
    ports:
      - "8080:8080"
      - "50000:50000"
    privileged: true
    user: root
    volumes:
      - ./jenkins_home:/var/jenkins_home
    restart: always

Then you will be able to up the jenkins container successfully by running "docker-compose up -d".

Katakana

Answer 8

I fixed it by updating permissions.

apiVersion: apps/v1
kind: Deployment
metadata:
  name: jenkins
  namespace: devops-tools
spec:
  replicas: 1
  selector:
    matchLabels:
      app: jenkins-server
  template:
    metadata:
      labels:
        app: jenkins-server
    spec:
      **securityContext:
            fsGroup: 1000
            runAsUser: 0****
      serviceAccountName: jenkins-admin
      containers:
        - name: jenkins
          image: jenkins/jenkins:lts
          resources:
            limits:
              memory: "2Gi"
              cpu: "1000m"
            requests:
              memory: "500Mi"
              cpu: "500m"
          ports:
            - name: httpport
              containerPort: 8080
            - name: jnlpport
              containerPort: 50000
          livenessProbe:
            httpGet:
              path: "/login"
              port: 8080
            initialDelaySeconds: 90
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 5
          readinessProbe:
            httpGet:
              path: "/login"
              port: 8080
            initialDelaySeconds: 60
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3
          volumeMounts:
            - name: jenkins-data
              mountPath: /var/jenkins_home
      volumes:
        - name: jenkins-data
          persistentVolumeClaim:
              claimName: jenkins-pv-claim

Breezeway

Please don't add "thank you" as an answer. Once you have sufficient reputation, you will be able to vote up questions and answers that you found helpful. - From Review – Waitabit

Answer 9

Had a similar issue on MacOS, I had installed Jenkins using helm over a Minikube/Kubenetes after many intents I fixed it adding runAsUser: 0 (as root) in the values.yaml I use to deploy jenkins.

master:
  usePodSecurityContext: true
  runAsUser: 0
  fsGroup: 0

Just be careful because that means that you will run all your commands as root.

Dnieper

This might actually be a beginning to a solution. Can you create a user with the same UID and GID as the user on the host, and run as that user? I cannot upvote this recommendation to run as root, but it does seem to be on the right track. – Aniseed

Yes, you can use any user. – Dnieper

Answer 10

use this command

$ chmod +757 /home/your-user/your-jenkins-data

Bemean

While this code may answer the question, providing additional context regarding why and/or how this code answers the question improves its long-term value. – Prejudicial

Answer 11

This error solve using following commnad.

goto your jenkins data mount path : /media

Run following command :

cd /media
sudo chown -R ubuntu:ubuntu sf_devops-workspaces

restart jenkins docker container

docker-compose restart jenkins

Arterial

Answer 12

first of all you can verify your current user using echo $USER command and after that you can mention who is the user in the Dockerfile like bellow (in my case user is root) screenshot

Smallminded

Answer 13

I had same issue it got resolved after disabling the SELINUX. It's not recommended to disable the SELINUX so install custom semodule and enable it. It works. Only changing the permissions won't work on CentOS 7.

Immunity

It is not recommended to disable SELinux, instead apply SELinux policy to the directory. – Guileless