Permission denied when creating a project from Container Image in OpenShift

3/10/2020

The Dockerfile I used to create this Docker Image. It works well in my local system.

FROM payara/server-full

COPY ./target/jakartaee8-starter.war $DEPLOY_DIR

It seems OpenShift runs docker by a none-root user. But payara/server-full is maintained by Payara, so it is not controlled by me. How to fix this in Openshift?

[Entrypoint] running /opt/payara/scripts/init_1_generate_deploy_commands.sh
touch: cannot touch '/opt/payara/config/post-boot-commands.asadmin': Permission denied
touch: cannot touch '/opt/payara/config/pre-boot-commands.asadmin': Permission denied
grep: /opt/payara/config/post-boot-commands.asadmin: No such file or directory
Adding deployment target /opt/payara/deployments/jakartaee8-starter.war to post boot commands
/opt/payara/scripts/init_1_generate_deploy_commands.sh: line 48: /opt/payara/config/post-boot-commands.asadmin: Permission denied

[Entrypoint] ignoring /opt/payara/scripts/init.d/*

touch: cannot touch '/opt/payara/config/post-boot-commands.asadmin': Permission denied
touch: cannot touch '/opt/payara/config/pre-boot-commands.asadmin': Permission denied
preboot commands file does not exist: /opt/payara/config/pre-boot-commands.asadmin
Usage: asadmin [asadmin-utility-options] start-domain
    [-v|--verbose[=<verbose(default:false)>]]
    [--upgrade[=<upgrade(default:false)>]]
    [-w|--watchdog[=<watchdog(default:false)>]]
    [-d|--debug[=<debug(default:false)>]]
    [-n|--dry-run[=<dry-run(default:false)>]]
    [--drop-interrupted-commands[=<drop-interrupted-commands(default:false)>]]
    [--prebootcommandfile <prebootcommandfile>]
    [--postbootcommandfile <postbootcommandfile>] [--domaindir <domaindir>]
    [-?|--help[=<help(default:false)>]] [domain_name]
ERROR: Command start-domain failed.
-- Hantsy
docker
kubernetes
openshift
payara

1 Answer

3/10/2020

You should update the security context permissions of the user and namespace.

e.g.

oc adm policy add-scc-to-user privileged -z default -n <YOUR_NAMESPACE>
-- lakshman.pasala
Source: StackOverflow