Skip to content

Multiple issues with Docker image from Dockerhub on Openshift/OKD

Description

I encountered multiple issues with Docker image from Dockerhub when I tried to get it to run on our Openshift cluster.

Steps to Reproduce

  1. Install Openshift/OKD/Minishift v4.x cluster
  2. Deploy the container framasoft/mobilizon:3.1.3

Expected behaviour:

Container starts / works

Actual behaviour:

Container doesn't start due to:

Versions

v3.1.3

Additional Information

Filesystem permissions

Openshift expects containers to run with arbitrary UID/GID, which is dynamically assigned to any namespace. Every location that the application needs to write to has to be either set up in such a way during the docker build (and it needs to be ensured that it contains no data that needs to be persisted), or has to be mounted via a persistent volume which is writable by the application.

However, Mobilizon docker container from https://hub.docker.com/r/framasoft/mobilizon doesn't conform to that.

The following location needs to be writeable, and it seems that it also contains data that should be persisted during container restarts:

  • /var/lib/mobilizon

This is also mentioned in #1296 (closed), but not directly pointed out to the user on the Dockerhub page (or in the documentation, for that matter). This could also lead to data loss at runtime and I think it would be important to point that out to users.

Furthermore, at runtime the application tries to write a sitemap into a directory which contains static, prepacked content, and which should probably not contain any data that changes on runtime:

  • /lib/mobilizon-3.1.3/priv/static/sitemap-00001.xml
18:06:15.874 [info] {"error":"** (File.Error) could not write to file \"/lib/mobilizon-3.1.3/priv/static/sitemap-00001.xml\": permission denied","args":{},"id":11048,"meta":{},"state":"failure","max_attempts":20,"queue":"background","tags":[],"worker":"Mobilizon.Service.Workers.BuildSiteMap","source":"oban","duration":42008,"event":"job:exception","attempt":8,"queue_time":231433}

I couldn't find any way to reconfigure the application to write the sitemap to another directory. also, mounting a volume to /lib/mobilizon-3.1.3/priv/static is not possible, since it would overwrite necessary files (and also the path would change with every update, which makes this unmaintainable).

Reference: https://framagit.org/framasoft/mobilizon/-/blob/main/docker/production/Dockerfile

PostgresSQL connection

Although certain database parameters are configurable in the environment, the database port is hardcoded in e.g. https://framagit.org/framasoft/mobilizon/-/blob/main/docker/production/docker-entrypoint.sh to the PostgreSQL default port 5432 , which makes this unusable in anything but the most default setups.

Furthermore, it is not possible to configure the environment to not use prepared statements in case a connection pooler like e.g. pgbouncer is used.

In the end I had to resolve this by completely overriding the container start command, and mounting config.exs into the container via a configmap.

I added prepare: :unnamed to the config to disable prepared statements, is this correct? I couldn't find much information regarding this online.

config :mobilizon, Mobilizon.Storage.Repo,
  adapter: Ecto.Adapters.Postgres,
  prepare: :unnamed