How do I fix OpenShift permission denied error?

Question

I'm try to run OrientDB docker container in OpenShift. I encounter a permissions error when it tries to deploy. I'm using a Mac.

This is the error:

/orientdb/bin/server.sh: line 114: can't create /orientdb/bin/orient.pid: Permission denied

This is the Dockerfile that came with the official OrientDB-Docker GitHub repository.

FROM openjdk:8-jdk-alpine

MAINTAINER OrientDB LTD ([email protected])

# Override the orientdb download location with e.g.:
#   docker build -t mine --build-arg ORIENTDB_DOWNLOAD_SERVER=http://repo1.maven.org/maven2/com/orientechnologies/ .
ARG ORIENTDB_DOWNLOAD_SERVER

ENV ORIENTDB_VERSION 3.0.2
ENV ORIENTDB_DOWNLOAD_MD5 145e4836a3066783f0d2545af17b9e56
ENV ORIENTDB_DOWNLOAD_SHA1 9aae978d9943af6e82fb4707519239e60054f652

ENV ORIENTDB_DOWNLOAD_URL ${ORIENTDB_DOWNLOAD_SERVER:-http://central.maven.org/maven2/com/orientechnologies}/orientdb-community/$ORIENTDB_VERSION/orientdb-community-$ORIENTDB_VERSION.tar.gz

#RUN adduser orientdb root

RUN apk add --update tar curl \
    && rm -rf /var/cache/apk/*

#download distribution tar, untar and delete databases
RUN mkdir /orientdb && \
  wget  $ORIENTDB_DOWNLOAD_URL \
  && echo "$ORIENTDB_DOWNLOAD_MD5 *orientdb-community-$ORIENTDB_VERSION.tar.gz" | md5sum -c - \
  && echo "$ORIENTDB_DOWNLOAD_SHA1 *orientdb-community-$ORIENTDB_VERSION.tar.gz" | sha1sum -c - \
  && tar -xvzf orientdb-community-$ORIENTDB_VERSION.tar.gz -C /orientdb --strip-components=1 \
  && rm orientdb-community-$ORIENTDB_VERSION.tar.gz \
  && rm -rf /orientdb/databases/*

ENV PATH /orientdb/bin:$PATH

VOLUME ["/orientdb/backup", "/orientdb/databases", "/orientdb/config"]

WORKDIR /orientdb

# new new
#RUN chmod -R g+rwx /orientdb

#OrientDb binary
EXPOSE 2424

#OrientDb http
EXPOSE 2480

USER 1000

# Default command start the server
CMD ["server.sh"]

Solution

That image is built as root and needs to run as the root user. By default, OpenShift won't allow it to run as root but you can enable it by adding the permission to the service account that runs the container:

oc adm policy add-scc-to-user anyuid -z default

Be aware that this is a security risk and recommended best practice is to avoid containers that need to run as root.

https://blog.openshift.com/understanding-service-accounts-sccs/ https://blog.openshift.com/getting-any-docker-image-running-in-your-own-openshift-cluster/