CODEWITHSUNDEEP
tomcatdockerdebian
mistapink
mistapink

Reputation: 1956

Can't start tomcat within docker: "Permission denied"

I have the following docker file:

FROM debian:jessie
RUN apt-get update && apt-get install -y wget

RUN wget --quiet http://www.us.apache.org/dist/tomcat/tomcat-8/v8.5.20/bin/apache-tomcat-8.5.20.tar.gz -O /tmp/tomcat.tar.gz
RUN cd /tmp && tar xf tomcat.tar.gz
RUN mv /tmp/apache-tomcat-8.5.20 /usr/share/
RUN adduser --system --shell /bin/bash --gecos 'Tomcat Java Servlet and JSP engine' --group --disabled-password --home /home/tomcat tomcat
RUN chown -R tomcat:tomcat /usr/share/apache-tomcat-8.5.20/*
RUN chmod +x /usr/share/apache-tomcat-8.5.20/bin/*.sh

RUN apt-get update && apt-get install -y openjdk-7-jre-headless

CMD ["/bin/bash"]

If I compile this on my laptop with Ubuntu 17.04 and docker 1.12.6, build 78d1802, I can execute

su tomcat -c /usr/share/apache-tomcat-8.5.20/bin/startup.sh

without any problems:

$ sudo docker run -it ff1323fadc66
root@728de06f43be:/# su tomcat -c /usr/share/apache-tomcat-8.5.20/bin/startup.sh
Using CATALINA_BASE:   /usr/share/apache-tomcat-8.5.20
Using CATALINA_HOME:   /usr/share/apache-tomcat-8.5.20
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-8.5.20/temp
Using JRE_HOME:        /usr
Using CLASSPATH:       /usr/share/apache-tomcat-8.5.20/bin/bootstrap.jar:/usr/share/apache-tomcat-8.5.20/bin/tomcat-juli.jar
Tomcat started.

However if I try the same on Ubuntu 16.04 LTS with docker 1.12.6, build 78d1802, which is hosted on AWS, I get the following output:

$ sudo docker run -it 96e0e82a9dda
root@f8f7d3fd6917:/# su tomcat -c /usr/share/apache-tomcat-8.5.20/bin/startup.sh
Using CATALINA_BASE:   /usr/share/apache-tomcat-8.5.20
Using CATALINA_HOME:   /usr/share/apache-tomcat-8.5.20
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-8.5.20/temp
Using JRE_HOME:        /usr
Using CLASSPATH:       /usr/share/apache-tomcat-8.5.20/bin/bootstrap.jar:/usr/share/apache-tomcat-8.5.20/bin/tomcat-juli.jar
touch: cannot touch '/usr/share/apache-tomcat-8.5.20/logs/catalina.out': Permission denied
/usr/share/apache-tomcat-8.5.20/bin/catalina.sh: 434: /usr/share/apache-tomcat-8.5.20/bin/catalina.sh: cannot create /usr/share/apache-tomcat-8.5.20/logs/catalina.out: Permission denied

How is this possible? Shouldn't the docker file produce the same environment? I also tried it on MacOS and it worked like charm to start tomcat there as well.

I already tried to circumvent this with chmod 777 /usr/share/apache-tomcat-8.5.20/logs/ but it didn't work either.

Edit:

As requested the output of ls -alh /usr/share/apache-tomcat-8.5.20/logs/

root@ce87bb8feb9b:/# su tomcat -c /usr/share/apache-tomcat-8.5.20/bin/startup.sh
Using CATALINA_BASE:   /usr/share/apache-tomcat-8.5.20
Using CATALINA_HOME:   /usr/share/apache-tomcat-8.5.20
Using CATALINA_TMPDIR: /usr/share/apache-tomcat-8.5.20/temp
Using JRE_HOME:        /usr
Using CLASSPATH:       /usr/share/apache-tomcat-8.5.20/bin/bootstrap.jar:/usr/share/apache-tomcat-8.5.20/bin/tomcat-juli.jar
touch: cannot touch '/usr/share/apache-tomcat-8.5.20/logs/catalina.out': Permission denied
/usr/share/apache-tomcat-8.5.20/bin/catalina.sh: 434: /usr/share/apache-tomcat-8.5.20/bin/catalina.sh: cannot create /usr/share/apache-tomcat-8.5.20/logs/catalina.out: Permission denied
root@ce87bb8feb9b:/# ls -alh /usr/share/apache-tomcat-8.5.20/logs/
total 8.0K
drwxr-x---  2 tomcat tomcat 4.0K Aug  2 21:35 .
drwxr-xr-x 17 root   root   4.0K Sep  6 06:58 ..
root@ce87bb8feb9b:/#

Furthermore: Of course it is possible to start tomcat without switching the user and then use root, but I'd rather want to avoid that.

Edit2:

The host is a Ubuntu 16.04.3 LTS:

$ cat /etc/os-release 
NAME="Ubuntu"
VERSION="16.04.3 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.3 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

It also has a dev-log:

$ ls -l /run/systemd/journal/dev-log 
srw-rw-rw- 1 root root 0 Sep  5 13:13 /run/systemd/journal/dev-log

Upvotes: 1

Views: 3959

Answers (3)

awoj
awoj

Reputation: 1

1.Exec container: docker exec -it <CONTAINER ID> bash

2. Install and use nano, vim or other editor;

3. Edit

3.1. according to: https://tomcat.apache.org/tomcat-8.0-doc/manager-howto.html

/conf/tomcat-users.xml

/webapps/host-manager/manager.xml

3.2 /webapps/manager/META-INF/context.xml comment lines <!-- <Valve className="org.apache.catalina.valves.RemoteAddrValve" allow="127\.\d+\.\d+\.\d+|::1|0:0:0:0:0:0:0:1" /> -->

Then restart your docker image or: 

./shutdown.sh
./startup.sh

You can probably try to specify other IPs to allow them in /webapps/manager/META-INF/context.xml

WARNIG: It was my test setup, not for buisness solution !

Upvotes: 0

so-random-dude
so-random-dude

Reputation: 16465

I cannot stop wondering why re-invent the wheel, what is wrong with the official tomcat image?. https://docs.docker.com/samples/library/tomcat/ or https://hub.docker.com/_/tomcat/

https://stackoverflow.com/a/29297790/6785908

Upvotes: 0

Tarun Lalwani
Tarun Lalwani

Reputation: 146510

So this one seemed to be weirdest one, I am not sure the root case of this not working but below options would work for you

Change user to tomcat and then extract folders

FROM debian:jessie
RUN apt-get update && apt-get install -y wget openjdk-7-jre-headless

RUN adduser --system --shell /bin/bash --gecos 'Tomcat Java Servlet and JSP engine' --group --disabled-password --home /home/tomcat tomcat
USER tomcat
RUN wget --quiet http://www.us.apache.org/dist/tomcat/tomcat-8/v8.5.20/bin/apache-tomcat-8.5.20.tar.gz -O /tmp/tomcat.tar.gz && cd /tmp && tar xf tomcat.tar.gz && mv /tmp/apache-tomcat-8.5.20/ /tomcat
USER root
CMD ["/bin/bash"]

Delete the logs folder and re-create it

FROM debian:jessie
RUN apt-get update && apt-get install -y wget openjdk-7-jre-headless

RUN adduser --system --shell /bin/bash --gecos 'Tomcat Java Servlet and JSP engine' --group --disabled-password --home /home/tomcat tomcat
RUN wget --quiet http://www.us.apache.org/dist/tomcat/tomcat-8/v8.5.20/bin/apache-tomcat-8.5.20.tar.gz -O /tmp/tomcat.tar.gz && cd /tmp && tar xf tomcat.tar.gz && mv /tmp/apache-tomcat-8.5.20/ /tomcat
RUN rm -rf /tomcat/logs && chown -R tomcat:tomcat /tomcat && su tomcat -c "mkdir /tomcat/logs"
CMD ["/bin/bash"]

Above solutions work in your case. The root cause of behaviors being different in two OS is yet unknown

Paste bins for any one interested to debug

strace su tomcat -c /tomcat/logs/text.txt

https://pastebin.com/vVBEXJQ1

actual final dockerfile used

https://pastebin.com/H5AVt9P5

Upvotes: 4

Related Questions