• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar

The Geek Diary

CONCEPTS | BASICS | HOWTO

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • Linux Services
    • VCS
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
    • Data Guard
  • DevOps
    • Docker
    • Shell Scripting
  • Interview Questions
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

Unable to run NGINX Docker due to “13: Permission denied”

By admin

The Problem

The NGINX docker container was started using the below command:

# docker run --detach --name nginx_server nginx
4ffbcd5ee796b8cce3f2c6ed4cce8927d2b13a040af07b36f7a866b2157290e8

But user failed to get connection to the NGINX server. Upon troubleshooting user found below error logs:

# tail -f /var/log/audit/audit.log
type=AVC msg=audit(1565283160.116:316): avc: denied { write } for pid=2387 comm="nginx" name="nginx" dev="dm-0" ino=140648937 scontext=system_u:system_r:container_t:s0:c345,c550 tcontext=system_u:object_r:container_share_t:s0 tclass=dir permissive=0
type=SYSCALL msg=audit(1565283160.116:316): arch=c000003e syscall=83 success=no exit=-13 a0=56247859585f a1=1c0 a2=0 a3=8 items=0 ppid=2371 pid=2387 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="nginx" exe="/usr/sbin/nginx" subj=system_u:system_r:container_t:s0:c345,c550 key=(null)
# docker logs nginx_server
2019/08/08 16:52:40 [emerg] 1#1: mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)
nginx: [emerg] mkdir() "/var/cache/nginx/client_temp" failed (13: Permission denied)

The Solution

AVC denial messages indicates container_t is not a permissive domain, therefore is not possible to write (13: Permission denied). In order to resolve this issue, add container_t in the SELinux.

# semanage permissive -a container_t
# semodule -l | grep permissive
permissive_container_t (null)
permissivedomains (null)

Try again to run the nginx container using -p option. With -p, it is possible to redirect the port from the docker to the host(ensure firewall is properly configured in the host).

# docker run --detach --name nginx_server -p 8080:80 nginx
2ce7b13f17c8aeaaa0e6f434ce47a16f6ed7bf94affb7f75381636fe7fdf496c

Verify if the docker is running:

# docker ps -a
CONTAINER ID   IMAGE   COMMAND                   CREATED         STATUS         PORTS                  NAMES
2ce7b13f17c8   nginx   "nginx -g 'daemon of…"    3 seconds ago   Up 3 seconds   0.0.0.0:8080->80/tcp   nginx_server

Connect to NGINX container and verify the nginx version.

# docker exec nginx_server nginx -v
nginx version: nginx/1.17.2

Filed Under: DevOps, Docker

Some more articles you might also be interested in …

  1. Understanding Variables in Bash Shell Under Linux
  2. How to Configure Btrfs as the Storage Engine in Docker
  3. How To Change The Time Zone For A Docker Container
  4. Bash if loop examples (if then fi, if then elif fi, if then else fi)
  5. Docker Troubleshooting – “conflict: unable to delete, image is being used by running container”
  6. Endpoint is not Created for Service in Kubernetes
  7. New User Failed Run Kubectl with Error “The connection to the server xxx.xxx.xxx was refused – did you specify the right host or port?”
  8. How to configure docker to use proxy
  9. How to Build and push Docker Image to the Docker Hub Repository
  10. How to List / Start / Stop / Delete docker Containers

You May Also Like

Primary Sidebar

Recent Posts

  • What are different Oracle Database Vault Roles
  • Unable to export realm protected table using data pump
  • Beginners Guide to Oracle Database Vault
  • How to Disable IPv6 on Ubuntu 18.04 Bionic Beaver Linux
  • Archives
  • Contact Us
  • Copyright

© 2021 · The Geek Diary