1

I'm trying to run Nginx as the docker container on SELinux enabled server with mounted configuration as

-v /host/path/nginx.conf:/etc/nginx/nginx.conf:Z

That works fine till I will deploy updated configuration using ansible playbook (user/group root and mode 0644) as

  tasks:
    - name: remove NGINX conf
      file:
        path: "/host/path/nginx.conf"
        state: absent
      become: true

    - name: copy NGINX conf
      become: true
      copy:
        src: "../nginx-conf/nginx.conf"
        dest: "/host/path/nginx.conf"
        mode: 0640
        owner: root
        group: root

and then reload nginx in the container as

docker container exec nginx-service nginx -s reload

that will error out with Permission Denied (13) to deployed configuration.

When I will check permissions to /host/path/nginx.conf those are correct (user/group:root and mode 0644) but for some reason nginx is not able to read that file.

When I will get inside the container and check /etc/nginx/nginx.conf permissions there are not carried over - they show up as question marks.

Any clue how to get it to work without reloading whole container just nginx service?

PS.

stat output inside the container before deployment:

  File: /etc/nginx/nginx.conf
  Size: 247         Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 25461574    Links: 1
Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-12-02 15:30:59.453867402 +0000
Modify: 2020-12-02 15:30:56.611769825 +0000
Change: 2020-12-02 15:30:56.937781018 +0000
 Birth: -

stat output after deployment:

stat: cannot stat '/etc/nginx/nginx.conf': Permission denied

and ls -la on that folder:

drwxr-xr-x. 2 root  root   30 Dec  2 16:11 .
drwxr-xr-x. 1 nginx nginx 215 Dec  2 16:00 ..
-?????????? ? ?     ?       ?            ? nginx.conf
3
  • Please provide the ansible command used to copy over the new configuration file. Also the exact output of stat /etc/nginx/nginx.conf from the container. – user23588 Dec 2 '20 at 10:10
  • @debdut I have added both to the OP. Thanks! – JackTheKnife Dec 2 '20 at 15:36
  • 1
    I think, if the container is running and mounting the single file (which is only possible, if the file exists before) turns the volume inside the docker container into trouble. So don't remove the file (handle) but override the content (like with template). Or better don't mount the file but the directory. – TRW Jan 16 at 17:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.