I could really use some help, if anyone can assist.
I am having a problem understanding how to properly set permissions for user IDs when running multiple containers for InfluxDB and Telegraf. My goal is to have the following:
- A named volume on the host system for storing InfluxDB /data/ and /wal/ directories
- A container for running the InfluxDB service
- A container for running a Telegraf service, which is able to obtain the directory sizes of the /data/ and /wal/ directories on the host system for monitoring purposes.
Here is my situation so far:
I am using podman (although this question also probably applies to Docker as well), and am setting everything up as a non-root user called tom (UID=1005). I create the volume using
$ podman volume create influxdb_volume
and then create the two containers using
$ podman run -d --rm --name influxdb_container \
--mount type=volume,source=influxdb_volume,destination=/var/lib/influxdb \
--mount type=bind,src=/home/tom/config_files/influxdb.conf,dst=/etc/influxdb/influxdb.conf \
--publish 8086:8086 \
influxdb:1.8
and
$ podman run -d --rm --name telegraf_container \
--mount type=bind,src=/home/tom/config_files/telegraf.conf,dst=/etc/telegraf/telegraf.conf \
--mount type=bind,src=/,dst=/hostfs \
-e HOST_MOUNT_PREFIX=/hostfs \
-e HOST_PROC=/hostfs/proc \
telegraf
You can see above that the entire host filesystem is mounted into the telegraf container to /hostfs (as recommended in the docs).
I can see that the influxdb container runs its process as root user inside the container:
$ podman run --rm influxdb:1.8 id
uid=0(root) gid=0(root) groups=0(root)
and that the telegraf container runs its process as a user called telegraf (UID=999) inside the container:
$ podman run --rm telegraf id
uid=999(telegraf) gid=0(root) groups=0(root),999(telegraf)
The influxdb named volume is located by default at /.local/share/containers/storage/volumes/ with the following permissions:
$ tree -pugd -L 3 /home/tom/.local/share/containers/storage/volumes/
/home/tom/.local/share/containers/storage/volumes/
└── [drwx------ tom tom ] influxdb_volume
└── [drwxr-xr-x 166534 166534 ] _data
├── [drwxr-xr-x tom tom ] data
├── [drwxr-xr-x tom tom ] meta
└── [drwx------ tom tom ] wal
To monitor the size of the /data/ and /wal/ directories, I have the following bash script get_disk_usage.sh which just uses the du command to print the directory size in bytes:
#!/bin/bash
echo "["
du -s -B1 "$@" | awk '{if (NR!=1) {printf ",\n"};printf " { \"dir_size_bytes\": "$1", \"path\": \""$2"\" }";}'
echo
echo "]"
The telegraf.conf file is then used to declare the script to run using the exec plugin:
[agent]
hostname = "qsd-23"
flush_interval = "5s"
interval = "5s"
[[inputs.mem]]
fieldpass = [ "available", "used" ]
[[inputs.exec]]
commands = [ "/hostfs/home/tom/get_disk_usage.sh
/hostfs/home/qsd/.local/share/containers/storage/volumes/influxdb_volume/_data/data
/hostfs/home/qsd/.local/share/containers/storage/volumes/influxdb_volume/_data/wal" ]
timeout = "1m"
name_override = "du"
name_suffix = ""
data_format = "json"
tag_keys = [ "path" ]
[[outputs.influxdb]]
database = "telegraf"
urls = [ "MY_IP:8086" ]
The problem is that the script doesn’t run due to a few permissions issues.
- The location on the host where the get_disk_usage.sh bash script is located is at /home/tom/ which is owned by the user tom. In order for the telegraf container to run this script (as telegraf user), this directory needs to be set to allow all other users to execute scripts.
- It can be seen above that the influxdb_volume directory has some unusual permissions as well, and need to be changed to allow the bash script to read their sizes inside the conatiner (and I do not have sudo access on the system).
What is the best was to configure the users to achieve what I am looking for? I am really confused about how to deal with the user tom on the host system (and whose home directory holds the bash scripts), the user telegraf who is running the process inside the telegraf container, and the root user inside the influxdb container (mapped with subuid onto the host filesystem) who owns the named volume data directory.
Thank you!
