Changing permissions of added file to a Docker vol

Question

In the Docker best practices guide it states:

You are strongly encouraged to use VOLUME for any mutable and/or user-serviceable parts of your image.

And by looking at the source code for e.g. the cpuguy83/nagios image this can clearly be seen done, as everything from nagios to apache config directories are made available as volumes.

However, looking at the same image the apache service (and cgi-scripts for nagios) are run as the nagios user by default. So now I'm in a pickle, as I can't seem to figure how to add my own config files in order to e.g. define more hosts for nagios monitoring. I've tried:

FROM cpuguy83/nagios
ADD my_custom_config.cfg /opt/nagios/etc/conf.d/
RUN chown nagios: /opt/nagios/etc/conf.d/my_custom_config.cfg
CMD ["/opt/local/bin/start_nagios"]

I build as normal, and try to run it with docker run -d -p 8000:80 <image_hash>, however I get the following error:

Error: Cannot open config file '/opt/nagios/etc/conf.d/my_custom_config.cfg' for reading: Permission denied

And sure enough, the permissions in the folder looks like (whist the apache process runs as nagios):

# ls -l /opt/nagios/etc/conf.d/
-rw-rw---- 1 root root 861 Jan  5 13:43 my_custom_config.cfg

Now, this has been answered before (why doesn't chown work in Dockerfile), but no proper solution other than "change the original Dockerfile" has been proposed.

To be honest, I think there's some core concept here I haven't grasped (as I can't see the point of declaring config directories as VOLUME nor running services as anything other than root) - so provided a Dockerfile as above (which follows Docker best practices by adding multiple volumes) is the solution/problem:

• To change NAGIOS_USER/APACHE_RUN_USER to 'root' and run everything as root?
• To remove the VOLUME declarations in the Dockerfile for nagios?
• Other approaches?

How would you extend the nagios dockerfile above with your own config file?

Answer 1

Since you are adding your own my_custom_config.cfg file directly into the container at build time just change the permissions of the my_custom_config.cfg file on your host machine and then build your image using docker build. The host machine permissions are copied into the container image.