如何让python脚本在docker容器中写入文件？

Question

我正在具有 Azure AD 授权的 Docker 容器中构建 Flask Web 应用程序。 当我使用微软提供的代码示例时，他们使用了flask-session模块。

我使用的代码可以在我的本地计算机上运行。当我构建 docker 容器时，写入已安装的 docker 卷时出现权限错误。

我尝试使用 root 和主机系统上具有相同 UID 的自定义用户强制对此目录授予权限。我不明白我做错了什么。我假设我必须强制对此文件系统的写入权限。

我的问题的核心是登录后会话数据未正确缓存在我的 Docker 容器中，最终导致登录循环。

目录不存在时出错：

Traceback (most recent call last):
  File "./main.py", line 1, in <module>
    from app import app
  File "/app/app/__init__.py", line 7, in <module>
    from app import views
  File "/app/app/views.py", line 22, in <module>
    Session(app)
  File "/usr/local/lib/python3.7/site-packages/flask_session/__init__.py", line 54, in __init__
    self.init_app(app)
  File "/usr/local/lib/python3.7/site-packages/flask_session/__init__.py", line 61, in init_app
    app.session_interface = self._get_interface(app)
  File "/usr/local/lib/python3.7/site-packages/flask_session/__init__.py", line 93, in _get_interface
    config['SESSION_USE_SIGNER'], config['SESSION_PERMANENT'])
  File "/usr/local/lib/python3.7/site-packages/flask_session/sessions.py", line 322, in __init__
    self.cache = FileSystemCache(cache_dir, threshold=threshold, mode=mode)
  File "/usr/local/lib/python3.7/site-packages/cachelib/file.py", line 41, in __init__
    os.makedirs(self._path)
  File "/usr/local/lib/python3.7/os.py", line 223, in makedirs
    mkdir(name, mode)

预创建目录时出错：

WARNING:root:Exception raised while handling cache file '/app/flask_session/2029240f6d1128be89ddc32729463129'
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/cachelib/file.py", line 196, in set
    suffix=self._fs_transaction_suffix, dir=self._path
  File "/usr/local/lib/python3.7/tempfile.py", line 340, in mkstemp
    return _mkstemp_inner(dir, prefix, suffix, flags, output_type)
  File "/usr/local/lib/python3.7/tempfile.py", line 258, in _mkstemp_inner
    fd = _os.open(file, flags, 0o600)
PermissionError: [Errno 13] Permission denied: '/app/flask_session/tmpdykbkzjx.__wz_cache'
 * Serving Flask app "app" (lazy loading)
 * Environment: production
   WARNING: This is a development server. Do not use it in a production deployment.
   Use a production WSGI server instead.
 * Debug mode: on
INFO:werkzeug: * Running on http://0.0.0.0:80/ (Press CTRL+C to quit)
INFO:werkzeug: * Restarting with stat
WARNING:root:Exception raised while handling cache file '/app/flask_session/2029240f6d1128be89ddc32729463129'
Traceback (most recent call last):
  File "/usr/local/lib/python3.7/site-packages/cachelib/file.py", line 196, in set
    suffix=self._fs_transaction_suffix, dir=self._path
  File "/usr/local/lib/python3.7/tempfile.py", line 340, in mkstemp
    return _mkstemp_inner(dir, prefix, suffix, flags, output_type)
  File "/usr/local/lib/python3.7/tempfile.py", line 258, in _mkstemp_inner
    fd = _os.open(file, flags, 0o600)
PermissionError: [Errno 13] Permission denied: '/app/flask_session/tmp2r6n8vby.__wz_cache'
WARNING:werkzeug: * Debugger is active!
INFO:werkzeug: * Debugger PIN: 187-625-763

Dockerfile：

  1 FROM python:3.7-slim-buster
  2 ARG UNAME=netpyth
  3 ARG UID=21268
  4 ARG GID=14625
  5 RUN groupadd -g $GID -o $UNAME
  6 RUN useradd -m -u $UID -g $GID -o -s /bin/bash $UNAME
  7 ENV STATIC_URL /static
  8 ENV STATIC_PATH /var/www/app/static
  9 WORKDIR /app
 10 COPY requirements.txt requirements.txt
 11 RUN pip3 install -r requirements.txt
 12 COPY . .
 13 RUN chmod +x ./main.py
 14 CMD ["python", "./main.py"]

构建docker容器的脚本：

1 #!/bin/bash
2 app="docker.wwwdev"
3 docker build -t ${app} .
4 docker run -it -d -p 56733:80 \
5   --name=${app} \
6   -v $PWD:/app ${app}

主机系统版本（RHEL）：

NAME="Red Hat Enterprise Linux Server"
VERSION="7.6 (Maipo)"
ID="rhel"
ID_LIKE="fedora"
VARIANT="Server"
VARIANT_ID="server"
VERSION_ID="7.6"
PRETTY_NAME="Red Hat Enterprise Linux"
ANSI_COLOR="0;31"
CPE_NAME="cpe:/o:redhat:enterprise_linux:7.6:GA:server"
HOME_URL="https://www.redhat.com/"
BUG_REPORT_URL="https://bugzilla.redhat.com/"

REDHAT_BUGZILLA_PRODUCT="Red Hat Enterprise Linux 7"
REDHAT_BUGZILLA_PRODUCT_VERSION=7.6
REDHAT_SUPPORT_PRODUCT="Red Hat Enterprise Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="7.6"

Answer 1

需要将UID和GID传递给docker run

docker container run --rm -it \
  -v $(app):/app \                          # Mount the source code
  --workdir /app \                          # Set the working dir
  --user 1000:1000 \                        # Run as the given user
  my-docker/my-build-environment:latest \   # Our build env image
  make assets                               # ... and the command!

示例这里