Permission denied to access /var/run/docker.sock m

Question

Objective

Know how to trouble shoot and what knowledge is required to trouble shoot permission issues of Docker container accessing host files.

Problem

Access to /var/run/docker.sock mounted inside a OpenShift container via hostPath causes permission denied. The issue does not happen if the same container is deployed to K8S 1.9.x, hence it is OpenShift specific issue.

[ec2-user@ip-10-0-4-62 ~]$ ls -laZ /var/run/docker.sock
srw-rw----. root docker system_u:object_r:container_var_run_t:s0 /var/run/docker.sock

[ec2-user@ip-10-0-4-62 ~]$ docker exec 9d0c6763d855 ls -laZ /var/run/docker.sock
srw-rw----. 1 root 1002 system_u:object_r:container_var_run_t:s0 0 Jan 16 09:54 /var/run/docker.sock

https://bugzilla.redhat.com/show_bug.cgi?id=1244634 says svirt_sandbox_file_t SELinux label is required for RHEL, so changed the label.

$ chcon -Rt container_runtime_t docker.sock 
[ec2-user@ip-10-0-4-62 ~]$ ls -aZ /var/run/docker.sock 
srw-rw----. root docker system_u:object_r:svirt_sandbox_file_t:s0 /var/run/docker.sock

Redeploy the container but still permission denied.

$ docker exec -it 9d0c6763d855 curl -ivs --unix-socket /var/run/docker.sock http://localhost/version
*   Trying /var/run/docker.sock...
* Immediate connect fail for /var/run/docker.sock: Permission denied
* Closing connection 0

OpenShift by default does not allow hostPath so it was addressed.

oc adm policy add-scc-to-user privileged system:serviceaccount:{{ DATADOG_NAMESPACE }}:{{ DATADOG_SERVICE_ACCOUNT }}

I suppose SELinux or OpenShift SCC or other container/docker permission is causing this but need a clue how to find the cause.

Answer 1

Openshift requires special permissions for in order to allow pods to use volumes in nodes.

Do the following:

1. Create standard security-context yaml:

   kind: SecurityContextConstraints
   apiVersion: v1
   metadata:
     name: scc-hostpath
   allowPrivilegedContainer: true
   runAsUser:
     type: RunAsAny
   seLinuxContext:
     type: RunAsAny
   fsGroup:
     type: RunAsAny
   supplementalGroups:
     type: RunAsAny
   users:
   - my-admin-user
   groups:
   - my-admin-group
   
   oc create -f scc-hostpath.yam
   

2. Add the "allowHostDirVolumePlugin" privilege to this security-context:

   oc patch scc scc-hostpath -p '{"allowHostDirVolumePlugin": true}'
   

3. Associate the pod's service account with the above security context

   oc adm policy add-scc-to-user scc-hostpath system:serviceaccount:<service_account_name>