chmod: changing permissions of 'var/lib/postgresql/data': Permission denied

[pueffl]

I have slightly extended the official postgres Image in the following way (only the COPY is really important, to do some stuff to use SonarQube with Postgres):

Version: 1.0.0

FROM postgres:9.5
MAINTAINER Wolfgang Grossinger "wolfgang.grossinger@gmail.com"
COPY sonarqube.sql /docker-entrypoint-initdb.d
RUN localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
ENV LANG en_US.utf8
ENV POSTGRES_PASSWORD=postgres
ENV POSTGRES_USER=postgres
RUN chmod 777 /var/lib/postgresql/data

After building the image I try to start it with the following command:

sudo docker run --name postgres_sonar -p 5432:5432 -v /data:/var/lib/postgresql/data wogro/postgres_sonar

I get the following error message:

chmod: changing permissions of ‘/var/lib/postgresql/data’: Permission denied

I don't know what the reason is (probably it's me), but it is something i would never expect from an official image (I just would expect that mounting a volume works :-))

[mrozekkk]

Hi,
Today I run official postgres:9.5 image without any changes under kubernetes and I got the same problem:
# kubectl logs my_pod -p
chmod: changing permissions of ‘/var/lib/postgresql/data’: Permission denied

edited:
Probably I have some clue -
chcon -Rt svirt_sandbox_file_t /path/to/volume
solves my problem - selinux issue

[yosifkit]

If you are using MacOSX or Windows with the Vbox shared folders, then this is a duplicate of #28

[sergio1990]

Hey, guys!
I have the same issue with running postgres on OSX.

docker run \
  --name my-postgres \
  -e POSTGRES_USER=admin \
  -e POSTGRES_PASSWORD=password \
  -e POSTGRES_DB=some_db_dev \
  -v $PG_LOCAL_DATA:/var/lib/postgresql/data \
  -d postgres:9.5.1

My output is the following:

* Starting PostgreSQL
The files belonging to this database system will be owned by user "postgres".
This user must also own the server process.

The database cluster will be initialized with locale "en_US.utf8".
The default database encoding has accordingly been set to "UTF8".
The default text search configuration will be set to "english".

Data page checksums are enabled.

fixing permissions on existing directory /var/lib/postgresql/data ... ok
initdb: could not create directory "/var/lib/postgresql/data/pg_xlog": Permission denied
initdb: removing contents of data directory "/var/lib/postgresql/data"

Versions of docker, docker-machine, virtualbox and boot2docker are:

docker-machine version 0.6.0, build e27fb87
Docker version 1.10.2, build c3959b1
VirtualBox Version 5.0.16 r105871
boot2docker 1.10.3

I saw many publications about this topic but the most of them are outdated. I had tried do the same solution as for mysql but it did not help.

Maybe somebody can updated me: does some solution exist to run postgres container with data volumes through docker-machine?

Thanks!

[caioariede]

Any workarounds for this?

[relaxdiego]

I'm experiencing the same error when trying to run the latest image on OpenShift Enterprise. The error occurs whether the container has or does not have a mounted volume:

chmod: changing permissions of ‘/var/lib/postgresql/data’: Permission denied

[fcurvat]

Hi,

Found this for solving the chmod issue:
http://stackoverflow.com/questions/24288616/permission-denied-on-accessing-host-directory-in-docker

Check here too for the selinux security issue :
https://docs.docker.com/engine/tutorials/dockervolumes/#/volume-labels

I fixed my docker-compose file by adding a :z at the end of the volume command
volumes: - /media/dataDemo/db:/var/lib/postgresql/data:z

Hope it will help.

[collinpeters]

I'm noticing that the /var/lib/postgresql/data group permission is root. That doesn't seem correct to me.

[yosifkit]

@collinpeters, it looks like we only chown to the user in the entrypoint.

[thiagoh]

any news about this issue?

[gcarter-comcast]

My issue appears like that of @sergio1990 except that I am using "Docker for Mac" instead of "Docker Toolbox". I resolved my case by changing ownership of the host file system to be used by the PostgresQL container to the $USER who will run that container. In doing so it appeared that the container relies upon the credentials cache resulting from the ownership change: sudo chown -R $USER $POSTGRESQLFS then docker run.

[marcofranssen]

I have been trying to apply the :z and :Z options in my kubernetes deployment configuration. However it fails with following error.

Failed to start container with docker id b323b283a475 with error: Error response from daemon: {"message":"SELinux relabeling of /var/lib/kubelet/pods/13a57233-0b02-11e7-bb55-0050560107db/volumes/kubernetes.io~nfs/sonar-data is not allowed: \"operation not supported\""}
Error syncing pod, skipping: failed to "StartContainer" for "sonar-postgres" with RunContainerError: "runContainer: Error response from daemon: {\"message\":\"SELinux relabeling of /var/lib/kubelet/pods/13a57233-0b02-11e7-bb55-0050560107db/volumes/kubernetes.io~nfs/sonar-data is not allowed: \\\"operation not supported\\\"\"}"
Back-off restarting failed docker container

Note that I have tried the mountPath with both :z and :Z in the following configuration. Without these it fails with the chown error mentioned by you guys.

apiVersion: extensions/v1beta1
kind: Deployment
metadata:
  name: sonar-postgres
spec:
  replicas: 1
  template:
    metadata:
      labels:
        app: sonar-postgres
        tier: backend
    spec:
      containers:
        - name: sonar-postgres
          image: postgres:9.6
          resources:
            requests:
              cpu: 100m
              memory: 100Mi
          env:
            - name: POSTGRES_USER
              valueFrom:
                secretKeyRef:
                  name: sonar-postgres
                  key: user
            - name: POSTGRES_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: sonar-postgres
                  key: password
          ports:
            - name: postgresport
              containerPort: 5432
          volumeMounts:
            - name: sonar-postgres-data
              mountPath: /var/lib/postgresql/data:z
      volumes:
        - name: sonar-postgres-data
          persistentVolumeClaim:
            claimName: sonar-postgres
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: sonar-postgres
  labels:
    app: sonar
    tier: backend
spec:
  capacity:
    storage: 500Mi
  accessModes:
    - ReadWriteMany
  nfs:
    server: x.x.x.x
    path: /kubernetes/volumes/sonar/postgres
---
apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: sonar-postgres
spec:
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 500Mi