Grafana 5.1.0 docker image - cant handle the permissions

Grafana Configuration
,
1

hi,
i was using the grafana docker image 4.2.0 everything was fine.
now when trying to use the 5.1.0 image i encounter massive permission errors,
i read the http://docs.grafana.org/installation/docker/#migration-from-a-previous-version-of-the-docker-container-to-5-1-or-later chapter several times and could not find a best practice workflow yet,

lets even say that i want to create the entire environment from scratch, every storage mount i use has a permission error.
how can i share any directory with the host ?
i tried logging in with user 104, and with the id -u workaround, nothing helps.

please help…

thanks.

2

Hi,

We need some details to be able to help you. If you could describe your setup or even share your docker-compose file if that is how you run the container (please be careful to remove any secrets).

3

hi,
i don’t currently use the composer , my run command is :

docker run (OPTIONAL --user root) -p 3000:3000 --name=grafana -v /home/new-grafana/grafana/etc/provisioning:/etc/grafana/provisioning -v /home/new-grafana/grafana/var/lib:/var/lib/grafana -v /home/new-grafana/grafana/var/log:/var/log/grafana -v /home/new-grafana/grafana/home_dash_files:/home/dash_files grafana/grafana:5.1.0

with this setup, the container will fail to start with message:
logger=sqlstore error=“Sqlstore::Migration failed err: unable to open database file\n”

the issue is that no matter what volume i share , if i go inside the container , i cant even ls to that dir with error message :permission denied"

any more info i forgot ?

4

Could you run ls -ltra in each of the folders that your map into the grafana container to find who is the owner of the files? (/home/new-grafana/grafana/etc/provisioning and so on)

Hopefully all those files are owned by the same user. If they are you should be able to boot the grafana container as that user to get it working. If they are different you may have to change some permissions.

The user running grafana inside of the container (472 by default) needs access to and subpaths/files:

  • /var/lib/grafana (read/write)
  • /etc/grafana (read)
  • /var/log/grafana (read/write, not used by default)
5

hi, as you can see they are all owned by root

image
image754×285 9.31 KB

and i tried using --user root and even id -u, still no permissions.

and i also tried chmod -p 777 /home/new-grafana , and still the container cannot read the folders.
i also tried chown -R 472 /home/new-grafana and changed the owner of all folder tree to 472 (grafana user id inside the container) , and still …

this is really strange :slight_smile:
any more ideas ?

thanks
David.

6

That setup should work, nothing out of the ordinary as long as you use --user root with docker run. My best guess would be that it is related to your Docker installation or your OS, or perhaps a combination thereof. What version of Docker are you running? Any specific security setups related to your centos install?

7

Hi. Nothing special. Latest docker from yum install on cents 7 on official minimal iso

8

The . at the end of the permission column in your ls output indicates that there are SELinux ACLs on those folders, that seems like a potential cause for your problems.

9

IMHO you need this:

$ ls -latr host-data-folder
 total 392 
 drwxrwxrwt. 33 root root   4096 May 11 15:32 ..
 drwxr-xr-x.  2  472  472      6 May 11 15:38 plugins
 -rw-r--r--.  1  472  472 393216 May 11 15:38 grafana.db
 drwxrwxrwx.  3 root root     37 May 11 15:38 .
10

how can i disable them ? or what should i do to fix this ?

11

didn’t understand what are you suggestion me to do ?

12

I don’t think there’s anyone here that knows SELinux well enough to help you unfortunately. You will have to figure out how to setup the permissions yourself. Alternatively you could probably just use docker volumes for persistant file storage instead of host bindings. I would presume that those wouldnt be affected by SELinux ACLs but I could be wrong.

13

can i just disable selinux ?
and the seccomp ?

14

Probably. You will have to read up on selinux I’m afraid.

15

found out what was the problem

i used yum install docker on that machine,
instead of yum install docker-ce.

this version is using different security or whatever, now it works, thanks.

1 Like
16

I’m glad to hear you got it figure out. Thanks for sharing the solution with us, will come in handy in the future!

1 Like