0

I'm playing around with docker and db2 but I'm getting into trouble when I try to execute commands as user db2inst1 into a running container. I start the container as (it is 1 line but I split it up for readability):

docker run -itd --name mydb2 --privileged=true -p 50000:50000 
  -e LICENSE=accept 
  -e DB2INST1_PASSWORD=pelle_paltnacke 
  --mount type=volume,dst=${backupdir},volume-driver=local,volume-opt=type=nfs,\"volume-opt=o=nfsvers=4,addr=${addr}\",volume-opt=device=:${device} 
  -v /etc/passwd:/etc/passwd 
  -v /etc/group:/etc/group 
  -v /opt/nya/users/db2inst1:/opt/nya/users/db2inst1 
  -v /home/system/db2fenc1/:/home/system/db2fenc1/ ibmcom/db2

Now, if I try to do:

docker exec --user db2inst1 -ti mydb2 bash -c "cat /etc/passwd | grep db2inst1"
unable to find user db2inst1: no matching entries in passwd file

As root there is no problem:

docker exec -ti mydb2 bash -c "cat /etc/passwd | grep db2inst1"
db2inst1:x:422:422:DB2 Instance Administrator 1:/opt/nya/users/db2inst1:/bin/bash

and also --user root works fine:

docker exec --user root -ti mydb2 bash -c "cat /etc/passwd | grep db2inst1"
db2inst1:x:422:422:DB2 Instance Administrator 1:/opt/nya/users/db2inst1:/bin/bash

So I tried with the uid from the mounted passwd file:

docker exec --user 422 -ti mydb2 bash -c "cat /etc/passwd | grep db2inst1"
db2inst1:x:422:422:DB2 Instance Administrator 1:/opt/nya/users/db2inst1:/bin/bash

/etc/passwd is readable for everyone. Anyhow, using the uid does not get me far:

docker exec --user 422 -ti mydb2 bash -c "db2licm -l"
bash: db2licm: command not found

so I try with:

docker exec --user 422 -ti mydb2 bash -c "whoami; . ~db2inst1/sqllib/db2profile; 
db2licm -l"
db2inst1
bash: /opt/nya/users/db2inst1/sqllib/adm/db2licm: Permission denied

This is just a couples of commands I ran to demonstrate the problem. Does anyone have an explanation as to why the --user db2inst1 is not able to execute them?

FWIW, I tried without the nfs-mount but I get the same behaviour.

The container itself seems to be working alright. If I spin up the container as above and:

#> docker exec -ti mydb2 bash
[root@0ee67959246f /]# mkdir -p /data/db/db2
[root@0ee67959246f /]# chown db2inst1:db2iadm1 /data/db/db2/
[root@0ee67959246f /]# su - db2inst1
[db2inst1@0ee67959246f ~]$ cd /data/backup/db2/wb11/MD000I11/
[db2inst1@0ee67959246f MD000I11]$ db2 "restore db MD000I11 incremental auto taken at 20220307141244 to /data/db/db2 into WD000I11"
DB20000I  The RESTORE DATABASE command completed successfully.

EDIT: An interesting observation is:

docker exec --user 422 -ti mydb2 bash -c "id"
uid=422(db2inst1) gid=0(root) groups=0(root)

docker exec --user 422:422 -ti mydb2 bash -c "id"
uid=422(db2inst1) gid=422(db2iadm1) groups=422(db2iadm1)


docker exec --user 422:422 -ti mydb2 bash -c "whoami; . 
~db2inst1/sqllib/db2profile; db2licm -l"

db2inst1
Product name:                     "DB2 Community Edition"
License type:                     "Community"
...

Unfortunate:

docker exec --user db2inst1:db2iadm1 -ti mydb2 bash -c "id"
unable to find user db2inst1: no matching entries in passwd file
3
  • Why do you mount /etc/passwd and the instance home directory from the Docker host? Aren't they part of the image?
    – mustaccio
    Commented Mar 7, 2022 at 15:55
  • passwd, group is to preserve uid etc. I'm trying to replace db2 on the host with a docker version and need to restore the backup(s) from the nfs mounted directory. At the moment I can't recall why I did mount /opt/nya/users/db2inst1, but I got an error when I executed something from within the container. The container it self works, and if I log in to the container and su - db2inst1, I can restore backups etc. Commented Mar 7, 2022 at 19:10
  • I never figured this out so I gave up. I ended up creating a container and moved the scripts there. It will be a few ifs and buts in ansible, but it will work. Commented Mar 10, 2022 at 11:29

1 Answer 1

0

The problem seems to be unrelated to the Db2 container. I created a Dockerfile with:

FROM registry.access.redhat.com/ubi8/ubi:8.5

as it's only content and could repeat the phenomena. I even removed all things but the mount of /etc/passwd and /etc/groups, but --user still fails.

It looks as if --user X becomes uid 1000 in the container, regardless of what username X is, what uid X has in /etc/passwd does not seem to be taken into consideration.

The two options I tried to get around this problem is:

Create a "dummy" user in the Dockerfile:

FROM ibmcom/db2

RUN groupadd --gid 422 db2iadm1
RUN useradd -u 422 -g db2iadm1 db2inst1
...

Or use the uid as an argument to --user:

docker exec --user 422:422 -ti mydb2 bash --login -c "db2licm -l"

Here I used --login to set up the correct environment.

Using podman should remove much of the hassle I guess

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.