search

quarkusio / quarkus

Quarkus: Supersonic Subatomic Java.
https://quarkus.io
Apache License 2.0
13.64k stars 2.65k forks source link

Since 3.12.0 filesystem write access during container build IT tests results in AccessDeniedException #41659

Closed HerrDerb closed 2 months ago

HerrDerb commented 3 months ago

Describe the bug

I have an application that creates dirs and writes files to the file system. In production, this directory is mounted. During test we used to write directly into the container.

With the update to 3.12.0 this seem not to be possible anymore as we get a AccessDeniedException: java.nio.file.AccessDeniedException: /home/jboss/myDir

Expected behavior

No change. Writing to the filesystem during a containerized test should still be possible

How to Reproduce?

https://github.com/HerrDerb/quarkus-issue/tree/container-write

when running with 3.12.0 the IT test will fail -> see target/quarkus.log when run with 3.11.3 the IT test will succeed

geoand commented 3 months ago

This is really weird. From 3.12 the container logs:

/opt/jboss/container/java/run/run-java.sh: line 147: /opt/jboss/container/java/jvm/java-default-options: Permission denied
/opt/jboss/container/java/run/run-java.sh: line 150: /opt/jboss/container/java/jvm/debug-options: Permission denied
INFO exec -a "java" java -Djava.util.logging.manager=org.jboss.logmanager.LogManager -cp "." -jar /home/jboss/quarkus-run.jar 
INFO running in /home/jboss
/opt/jboss/container/java/run/run-java.sh: line 147: /opt/jboss/container/java/jvm/java-default-options: Permission denied
/opt/jboss/container/java/run/run-java.sh: line 150: /opt/jboss/container/java/jvm/debug-options: Permission denied

where those Permission denied entries don't exist for 3.12. I have yet to discover what causes the problem...

geoand commented 3 months ago

@galderz this seems to be caused by 7493ab4ab24c7277067a0755354bb634bcdd5b5d, where we are using user 1000 for launching the container. This is incorrect for the container image created by Jib when running with Docker.

What was the reasoning behind this change?

geoand commented 3 months ago

Maybe we should only do call getVolumeAccessArguments when volumeMounts are not empty?

HerrDerb commented 2 months ago

Thank you 🙂👍

geoand commented 2 months ago

🙏🏼