Docker Container Files or Directories Have 'root:pf9group' (GID: 1001) Permissions

Problem

Within a Docker container that is spawned on a Platform9 Managed Kubernetes node, files and/or directories have pf9group (GID: 1001) set as the group owner despite the default (typically root/0) set within the container image.

Environment

• Platform9 Managed Kubernetes - v3.10-3.11

Cause

The ownership of the /var/lib/docker/aufs/diff directory is modified by Platform9's Support script in order to gather container logs necessary for troubleshooting. As a result, though, ownership of files and/or directories within running containers are inadvertently affected.

Resolution

1. Change ownership of the Docker data directory.

# chown -R root:root /var/lib/docker

2. Modify the permissions of the Docker container log directory.

# chmod -R a+rX /var/lib/docker/containers

Note: This is needed for Platform9 Support to obtain support bundles (archives of log files) which include container logs for troubleshooting. As the group the pf9 user is associated with no longer owns the /var/lib/docker directory, it is, otherwise impossible to gather this needed data without allowing the directory to be readable and executable by all users on the system.