Body: <p>I'm trying to run Nginx as the docker container on SELinux enabled server with mounted configuration as</p>
  <pre><code>-v /host/path/nginx.conf:/etc/nginx/nginx.conf:Z
  </code></pre>
  <p>That works fine till I will deploy updated configuration using ansible playbook (user/group root and mode 0644) as</p>
  <pre><code>  tasks:
      - name: remove NGINX conf
        file:
          path: &quot;/host/path/nginx.conf&quot;
          state: absent
        become: true
  
      - name: copy NGINX conf
        become: true
        copy:
          src: &quot;../nginx-conf/nginx.conf&quot;
          dest: &quot;/host/path/nginx.conf&quot;
          mode: 0640
          owner: root
          group: root
  </code></pre>
  <p>and then reload nginx in the container as</p>
  <pre><code>docker container exec nginx-service nginx -s reload
  </code></pre>
  <p>that will error out with Permission Denied (13) to deployed configuration.</p>
  <p>When I will check permissions to <code>/host/path/nginx.conf</code> those are correct (user/group:root and mode 0644) but for some reason nginx is not able to read that file.</p>
  <p>When I will get inside the container and check <code>/etc/nginx/nginx.conf</code> permissions there are not carried over - they show up as question marks.</p>
  <p>Any clue how to get it to work without reloading whole container just nginx service?</p>
  <p>PS.</p>
  <p>stat output inside the container before deployment:</p>
  <pre><code>  File: /etc/nginx/nginx.conf
    Size: 247         Blocks: 8          IO Block: 4096   regular file
  Device: fd00h/64768d    Inode: 25461574    Links: 1
  Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (    0/    root)
  Access: 2020-12-02 15:30:59.453867402 +0000
  Modify: 2020-12-02 15:30:56.611769825 +0000
  Change: 2020-12-02 15:30:56.937781018 +0000
   Birth: -
  </code></pre>
  <p>stat output after deployment:</p>
  <pre><code>stat: cannot stat '/etc/nginx/nginx.conf': Permission denied
  
  </code></pre>
  <p>and ls -la on that folder:</p>
  <pre><code>drwxr-xr-x. 2 root  root   30 Dec  2 16:11 .
  drwxr-xr-x. 1 nginx nginx 215 Dec  2 16:00 ..
  -?????????? ? ?     ?       ?            ? nginx.conf
  </code></pre>
  
Comments: CC BY-SA 4.0
Comments: 2020-12-02T15:36:44.237Z
Comments: @debdut I have added both to the OP. Thanks!
Comments: JackTheKnife
Comments: CC BY-SA 4.0
Comments: 2021-01-16T17:53:14.547Z
Comments: I think, if the container is running and mounting the single file (which is only possible, if the file exists before) turns the volume inside the docker container into trouble. So don't remove the file (handle) but override the content (like with `template`). Or better don't mount the file but the directory.
Comments: TRW
Tags: <docker><ansible><permissions><volume>
Title: Docker mount volume on SELinux enabled server
UserDisplayName: JackTheKnife
ThreadText: # Docker mount volume on SELinux enabled server
  
  (Asked by: username_0 on 2020-12-02)
  
  I'm trying to run Nginx as the docker container on SELinux enabled server with mounted configuration as
  
  ```
  -v /host/path/nginx.conf:/etc/nginx/nginx.conf:Z
  
  ```
  
  That works fine till I will deploy updated configuration using ansible playbook (user/group root and mode 0644) as
  
  ```
    tasks:
      - name: remove NGINX conf
        file:
          path: "/host/path/nginx.conf"
          state: absent
        become: true
  
      - name: copy NGINX conf
        become: true
        copy:
          src: "../nginx-conf/nginx.conf"
          dest: "/host/path/nginx.conf"
          mode: 0640
          owner: root
          group: root
  
  ```
  
  and then reload nginx in the container as
  
  ```
  docker container exec nginx-service nginx -s reload
  
  ```
  
  that will error out with Permission Denied (13) to deployed configuration.
  
  When I will check permissions to `/host/path/nginx.conf` those are correct (user/group:root and mode 0644) but for some reason nginx is not able to read that file.
  
  When I will get inside the container and check `/etc/nginx/nginx.conf` permissions there are not carried over - they show up as question marks.
  
  Any clue how to get it to work without reloading whole container just nginx service?
  
  PS.
  
  stat output inside the container before deployment:
  
  ```
    File: /etc/nginx/nginx.conf
    Size: 247         Blocks: 8          IO Block: 4096   regular file
  Device: fd00h/64768d    Inode: 25461574    Links: 1
  Access: (0640/-rw-r-----)  Uid: (    0/    root)   Gid: (    0/    root)
  Access: 2020-12-02 15:30:59.453867402 +0000
  Modify: 2020-12-02 15:30:56.611769825 +0000
  Change: 2020-12-02 15:30:56.937781018 +0000
   Birth: -
  
  ```
  
  stat output after deployment:
  
  ```
  stat: cannot stat '/etc/nginx/nginx.conf': Permission denied
  
  ```
  
  and ls -la on that folder:
  
  ```
  drwxr-xr-x. 2 root  root   30 Dec  2 16:11 .
  drwxr-xr-x. 1 nginx nginx 215 Dec  2 16:00 ..
  -?????????? ? ?     ?       ?            ? nginx.conf
  
  ```
  
  **Tags:** docker, ansible, permissions, volume
  
  > **Comments:**
  > **username_0**: @debdut I have added both to the OP. Thanks!  
  > **username_1**: I think, if the container is running and mounting the single file (which is only possible, if the file exists before) turns the volume inside the docker container into trouble. So don't remove the file (handle) but override the content (like with `template`). Or better don't mount the file but the directory.  
  
  ---
  
  ## 0 answers
  
  