<p>I'm trying to run Nginx as the docker container on SELinux enabled server with mounted configuration as</p>
<pre><code>-v /host/path/nginx.conf:/etc/nginx/nginx.conf:Z
</code></pre>
<p>That works fine till I will deploy updated configuration using ansible playbook (user/group root and mode 0644) as</p>
<pre><code>  tasks:
    - name: remove NGINX conf
      file:
        path: &quot;/host/path/nginx.conf&quot;
        state: absent
      become: true

    - name: copy NGINX conf
      become: true
      copy:
        src: &quot;../nginx-conf/nginx.conf&quot;
        dest: &quot;/host/path/nginx.conf&quot;
        mode: 0640
        owner: root
        group: root
</code></pre>
<p>and then reload nginx in the container as</p>
<pre><code>docker container exec nginx-service nginx -s reload
</code></pre>
<p>that will error out with Permission Denied (13) to deployed configuration.</p>
<p>When I will check permissions to <code>/host/path/nginx.conf</code> those are correct (user/group:root and mode 0644) but for some reason nginx is not able to read that file.</p>
<p>When I will get inside the container and check <code>/etc/nginx/nginx.conf</code> permissions there are not carried over - they show up as question marks.</p>
<p>Any clue how to get it to work without reloading whole container just nginx service?</p>
<p>PS.</p>
<p>stat output inside the container before deployment:</p>
<pre><code>  File: /etc/nginx/nginx.conf
  Size: 247         Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 25461574    Links: 1
Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-12-02 15:30:59.453867402 +0000
Modify: 2020-12-02 15:30:56.611769825 +0000
Change: 2020-12-02 15:30:56.937781018 +0000
 Birth: -
</code></pre>
<p>stat output after deployment:</p>
<pre><code>stat: cannot stat '/etc/nginx/nginx.conf': Permission denied

</code></pre>
<p>and ls -la on that folder:</p>
<pre><code>drwxr-xr-x. 2 root  root   30 Dec  2 16:11 .
drwxr-xr-x. 1 nginx nginx 215 Dec  2 16:00 ..
-?????????? ? ?     ?       ?            ? nginx.conf
</code></pre>

CC BY-SA 4.0
2020-12-02T15:36:44.237Z
@debdut I have added both to the OP. Thanks!
JackTheKnife
CC BY-SA 4.0
2021-01-16T17:53:14.547Z
I think, if the container is running and mounting the single file (which is only possible, if the file exists before) turns the volume inside the docker container into trouble. So don't remove the file (handle) but override the content (like with `template`). Or better don't mount the file but the directory.
TRW
<docker><ansible><permissions><volume>
Docker mount volume on SELinux enabled server
JackTheKnife
# Docker mount volume on SELinux enabled server

(Asked by: username_0 on 2020-12-02)

I'm trying to run Nginx as the docker container on SELinux enabled server with mounted configuration as
-v /host/path/nginx.conf:/etc/nginx/nginx.conf:Z

That works fine till I will deploy updated configuration using ansible playbook (user/group root and mode 0644) as
  tasks:
    - name: remove NGINX conf
      file:
        path: "/host/path/nginx.conf"
        state: absent
      become: true

    - name: copy NGINX conf
      become: true
      copy:
        src: "../nginx-conf/nginx.conf"
        dest: "/host/path/nginx.conf"
        mode: 0640
        owner: root
        group: root

and then reload nginx in the container as
docker container exec nginx-service nginx -s reload

that will error out with Permission Denied (13) to deployed configuration.
When I will check permissions to /host/path/nginx.conf those are correct (user/group:root and mode 0644) but for some reason nginx is not able to read that file.
When I will get inside the container and check /etc/nginx/nginx.conf permissions there are not carried over - they show up as question marks.
Any clue how to get it to work without reloading whole container just nginx service?
PS.
stat output inside the container before deployment:
  File: /etc/nginx/nginx.conf
  Size: 247         Blocks: 8          IO Block: 4096   regular file
Device: fd00h/64768d    Inode: 25461574    Links: 1
Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2020-12-02 15:30:59.453867402 +0000
Modify: 2020-12-02 15:30:56.611769825 +0000
Change: 2020-12-02 15:30:56.937781018 +0000
 Birth: -

stat output after deployment:
stat: cannot stat '/etc/nginx/nginx.conf': Permission denied


and ls -la on that folder:
drwxr-xr-x. 2 root  root   30 Dec  2 16:11 .
drwxr-xr-x. 1 nginx nginx 215 Dec  2 16:00 ..
-?????????? ? ?     ?       ?            ? nginx.conf

**Tags:** docker, ansible, permissions, volume

> **Comments:**
> **username_0**: @debdut I have added both to the OP. Thanks!  
> **username_1**: I think, if the container is running and mounting the single file (which is only possible, if the file exists before) turns the volume inside the docker container into trouble. So don't remove the file (handle) but override the content (like with `template`). Or better don't mount the file but the directory.  

---

## 0 answers

