CODEWITHSUNDEEP
google-cloud-platformgoogle-container-os
Matt Williamson
Matt Williamson

Reputation: 40203

Cannot run executable shell script on Google Container-Optimized OS

On any other linux distro, I can create a file with a shebang and run shell scripts like so:

$ chmod +x test.sh
$ ./test.sh Johnny
hello Johnny

But on Google Cloud Platform Container-Optimized OS, I get -bash: ./test.sh: Permission denied

If I prefix with sh e.g. sh test.sh Johnny it will work. How can I get this to work normally?

$ cat test.sh
#!/usr/bin/env sh

echo "Hello $@"

matt@rancher-4mmm /tmp/matt $ chmod +x test.sh 
matt@rancher-4mmm /tmp/matt $ sh ./test.sh matt
Hello matt

matt@rancher-4mmm /tmp/matt $ ./test.sh matt
-bash: ./test.sh: Permission denied
matt@rancher-4mmm /tmp/matt $ ls -la
total 4
drwxr-xr-x  2 matt matt  60 Feb 28 20:00 .
drwxrwxrwt 14 root root 280 Feb 28 19:59 ..
-rwxr-xr-x  1 matt matt  35 Feb 28 20:00 test.sh

Upvotes: 15

Views: 7624

Answers (4)

schnatterer
schnatterer

Reputation: 7859

One solution is to use another image family, e.g. ubuntu.

There, /tmp/ is not mounted with noexec.

Upvotes: 1

Adam Lydick
Adam Lydick

Reputation: 1122

If you want to run a binary one-off and don't want to deal with having another PD, you could also just mount a tmpfs device and run it from there.

sudo mkdir /mnt/disks/scratch
sudo mount -t tmpfs tmpfs /mnt/disks/scratch/

Upvotes: 3

joe miller
joe miller

Reputation: 321

Most filesystems on a COS node are mounted with "noexec" flag so you can't execute binaries from them.

Some workarounds:

  • For scripts, invoke the interpreter with the script as the argument, "bash /path/script.sh", "python /path/app.py"
  • Mount an extra data disk under /mnt/disks. You can mount it without the "noexec" flag. Use startup-script to mount at boot.

Upvotes: 21

N Singh
N Singh

Reputation: 327

Container-Optimized OS mounts the file-system with "noexec" flag except "Among the writable locations, only /var/lib/docker and /var/lib/cloud are mounted as "executable" (i.e. without the noexec mount flag)." [1]. You can verify with the following command:

mount | grep noexec

For more information on the layout of Container-Optimized OS (COS) file system, refer to the documentation. The 'noexec' option do not allow direct execution of any binaries on the mounted filesystem. This is because of by default security lock-down implementation on COS.

Upvotes: 6

Related Questions