Bind mounts and permissions

[kyletozer]

Hi Bret,

First off, just wanted to thank you for the fantastic material in your Udemy Docker Mastery course! And second off, after starting to dabble with containers and setups, I've been running into an issue with permissions when using bind mounts in a compose setup.

Anything created inside of the container is created with the containers permissions rightfully so and I am unable to modify the file or files on the host until I change the permissions. I was just wondering if there is a way around always having to change permissions on my host when something is created in the container? The setup in question that I'm testing is an attempt at dockerizing WordPress for practice.

The idea was to create a development environment where I could keep my site files out of the container and easily be able to edit them on the host through volume bind mapping but this is the issue I keep running into, is there a better way of doing what I am trying to do?

Here are my configs:

docker-compose.yml

version: '3.3'

services:
  db:
    image: mysql:5.7
    volumes:
      - db_data:/var/lib/mysql
    restart: always
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress

  phpmyadmin:
    image: phpmyadmin/phpmyadmin
    ports:
      - '8889:80'

  wordpress:
    depends_on:
      - db
    image: wordpress:5.2
    volumes:
      - ./src:/var/www/html
    ports:
      - '8888:80'
    restart: always
    environment:
      WORDPRESS_DB_HOST: db:3306
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
      WORDPRESS_DB_NAME: wordpress

volumes:
  db_data: {}

In the wordpress service, I am mapping the path to the wordpress installation in the container to the src folder in my project. Appreciate any help with this, Thanks again!

[robodude666]

@kyletozer Are you on Windows, Mac, or Linux? Docker Desktop or Docker Toolbox?

[kyletozer]

@robodude666 I am using Docker Desktop on Ubuntu Desktop 18.04.

[robodude666]

@kyletozer I haven't used Docker on native linux yet, but I believe since the daemon is running as root and the container is running as root internally (or some other user) you can't mount a non-root directory to the container.

I believe you'd have to make ./src owned by root, but I could be wrong. You may also be able to change the /var/www/html's permissions inside of the container too.

Try rootless mode as an alternative which was introduced recently.

[BretFisher]

@kyletozer there is no Docker Desktop for Linux, I'm confused.

[BretFisher]

You might try adding user: root to your wordpress compose service, and see if that helps for development bind-mount permissions. Don't do that in image or production, of course.
Docker Desktop (macOS/Windows10) affects permissions differently then a Linux desktop. DD will do things to make it easier to work across OS's. Linux bind-mounts don't touch the file perms at all so you might also have to do a custom entrypoint script for development only (entrypoint: scriptname.sh in your compose) that changes permissions on each container start.

[kyletozer]

Sorry for the confusion @BretFisher, I didn't mean Docker Desktop for Linux, just installed it and running it through the command line on Ubuntu desktop.

I've found a temporary workaround that works quite well by using a feature of VS Code to connect remotely to my container and edit files directly on the container, allowing me to bypass any permissions issues I am currently having between my host and my containers.

But perhaps I am doing things backwards? The files I am having trouble with were actually created on the container. These are not files that were originally created on my machine and placed in the bind mount folder after running docker-compose up.

I have tried your first suggestion of adding user: root but no luck with that. Do you know of any useful guides that deal specifically with setting up local development environments with docker? I will try your other suggestions this weekend and get back to you.

[BretFisher]

I don't know of a walk through. But things are simpler in "docker on linux" because it's just pure Linux, there's actually no magic there, you just need to understand how Linux uses users, groups (uid, gid) and tools like chown/chmod. Every file has a user and group owner, and those are just numbers (user id, group id). The container will start the app as a uid:gid but those id's may not exist on the host, which is fine, it's a simple number matching system.

So if a file is created in container as the Dockerfile USER directive, lets say that has a uid:gud of 999:999
That file really lives on the host in /var/lib/docker, unless you bind-mount it, so it'll live wherever you tell it. The key is that your user on the host has it's own uid, maybe that's 1001, and it can be in any host groups you want it to be in, so sometimes you can just "fake it" by making a new group in host /etc/group with gid of 999, and then using chmod in container to ensure that group has write to all the files.
Basically this has very little to do with docker, and more to do with:

• Understanding the user that's writing the files in the container. What uid:gid is that USER dockerfile directive?
• Ensuring that the user you are on your host, has either a matching uid as the user in container or that your host user is in a group that has write access to those files.

Each use case is different so it's hard to give a "run this command to fix it" because it's all just Linux permissions problems. Once you learn the ends and outs of how file permissions and uid:gid work in Linux, the rest should work itself out :)

[lonix1]

@kyletozer

I've found a temporary workaround that works quite well by using a feature of VS Code to connect remotely to my container and edit files directly on the container, allowing me to bypass any permissions issues I am currently having between my host and my containers.

Please advise what vscode feature or plugin allows you to do that? It would be very helpful!

[BretFisher]

@lonix1 I think their talking about VS Code Remote. It's multiple extensions depending on how you want to access your code, including "Remote - Containers" extension: https://code.visualstudio.com/docs/remote/remote-overview