Get access to container files

[mlagneaux]

Hello,

I have questions about this container :

• How can I modify tomcat-users.xml file ?
• How do I get access to the files of the container ?
• Which OS this container is based on ? Is it possible to install other packages ?

Thanks in advance for your answers.

[bryantrobbins]

Having the same problem here.

My first inclination was to mount a volume to the relevant locations, but volumes are mounted as "root" by default and not readable by the "tomcat" user running the default command of this container.

Another alternative would be to create a Dockerfile which builds FROM this image and adds its own files. This would mean rebuilding the container image for every version of a webapp. Can maintainers comment on whether this is the intended (long-term) design?

ETA: Asking about design because I'd be happy to contribute something that makes pushing in webapps simpler!

[yosifkit]

@bryantrobbins, as a complete noob when it comes to using tomcat I am all ears on what you think users of the image would want to use. I may push back with some of our design principles for the official images, but I am sure we can work to make this a more friendly image.

[bryantrobbins]

Thanks @yosifkit. I definitely have some ideas.

First and foremost, we are really running into a Docker limitation documented here: moby/moby#7198

I have a local PoC which adds a wrapper script to the tomcat:8.0 for copying around mounted files. This init.sh script could copy in anything from a mounted volume then change owner to tomcat so that users can override default Tomcat files, including deploying webapps. Currently I'm just copying in webapps, but it could be used to add tomcat-users.xml or other files.

Obviously this could potentially be merged into the Dockerfile of the Tomcat images directly if desired, so that there is no need for users to build their own images.

Let me know what you think!

Dockerfile:

FROM tomcat:8.0
MAINTAINER Bryan Robbins bryantrobbins@gmail.com

USER root
WORKDIR /

ADD init.sh /
RUN chmod +x /init.sh

CMD ["/init.sh"]

Where init.sh is:

#!/bin/bash

# Copy webapps from mount to CATALINA_HOME
cp /etc/tomcat/webapps/* $CATALINA_HOME/webapps

# Change owner of webapps copied back to tomcat
chown -R tomcat:tomcat $CATALINA_HOME/webapps

# Run catalina.sh as tomcat user
su -c "/usr/local/tomcat/bin/catalina.sh run" -s /bin/bash tomcat

[jgangemi]

is there a reason these directories can't be exposed as mount points?

[yosifkit]

You can docker run -it -v /my/webapp/:/catalina/dir/webapp/ tomcat but the files will be owned by whatever user you created them with and tomcat user in the container will not have access to them. We solve this on the database images like postgres and mongodb to just chown all the files in the entrypoint of the container, but then when the container stops all the files will still be owned by the user in the container.

[jgangemi]

mounting a local directory into the container is not an option, i need to do this using data containers.

[jgangemi]

anyone?

[yosifkit]

@jgangemi, that is just done with -v /place/in/container/for/volume and --volumes-from=myTomcat (https://docs.docker.com/userguide/dockervolumes/).

@bryantrobbins, I am not sure what we would gain with the script that copies files from the mounted volume and copy script that we could not just get by adding COPY webapp/ $CATALINA_HOME/webapps and chowning them. The reason for using a host mounted volume is so that local changes will reflect in the container, but your solution would not be able to do that.

[jgangemi]

odd - i thought i tried that but it didn't want to mount over $CATALINA_HOME/webapps which is what i would like to have happen so i don't need to copy files around in the container, etc.

i will try again.

[bryantrobbins]

@yosifkit So far, I have not been able to use a host-mounted volume with this container. I'm probably missing something.

If I run a command like this, where /tmp/webapps contains a war:
docker run -dit -v -p 8080:8080 /tmp/webapps:/usr/local/tomcat/webapps tomcat:8.0

I get one of these in the logs:
java.io.IOException: Unable to create the directory [/usr/local/tomcat/webapps/appname]

[yosifkit]

Yeah, the problem is that tomcat runs as the tomcat user, but all the files are still owned by your local user. We could change it so that on startup it chowns the files and then runs as tomcat, but then all your files are now chowned. I think the simpler solution is to just drop the tomcat user and run as root.

[jgangemi]

i'm hitting this issue now too - why does it matter if the files get chowned to tomcat? ownership/permissions would need to be set to something tomcat can handle if this was deployed outside of docker, so why is this any different?

making tomcat run as root inside docker is ok by me as well, i'm just looking to use the startup script that comes w/ the container instead of rolling my own, although that may still be required to enable jmx remoting.

[bryantrobbins]

@yosifkit agree that running as root makes sense

EDIT: Please see numerous comments below correcting this.

[yosifkit]

@jgangemi, true you should set permissions when you deploy, but if you are just build testing on your own box then chowning all of the files to the UID of tomcat in the container every time you change and want to run would get exhausting (even if we did it on startup of the container, you would still have to chown it back we you want to edit or overwrite it).

I'll put up a PR to change to root from the tomcat user, so that other users will not have to worry about permissions.