kumaab commented on code in PR #1195:
URL: https://github.com/apache/ranger/pull/1195#discussion_r3884506871
##########
dev-support/ranger-docker/docker-compose.ranger-audit-service.yml:
##########
@@ -134,8 +134,8 @@ services:
hostname: ranger-opensearch.rangernw
volumes:
-
./scripts/opensearch/opensearch.yml:/usr/share/opensearch/config/opensearch.yml
- - opensearch-data:/usr/share/opensearch/data
Review Comment:
Let's keep the `named volumes` here instead of switching to ./-relative
`bind mounts` ?
1. The switch from named volumes (storage that Docker creates and manages
internally) to ./-relative bind mounts is breaking CI — ranger-audit-ingestor
exits(1) on startup in the services-docker-build job:
https://github.com/apache/ranger/actions/runs/33148952833/job/98883370423?pr=1195
Root cause: the `ingestor` image runs as non-root (USER `ranger`) and
writes to `/var/log/ranger/audit-ingestor` and
`/var/log/ranger/audit-ingestor/audit`.
With named volumes, Docker initializes the volume from the image and
preserves the `ranger:ranger` ownership set in the Dockerfile, so the process
can write. With bind mounts, Docker creates the host dirs as `root:root` on a
Linux host and does not copy image ownership, so ranger can't write to its
log/spool dir and the container dies immediately.
This doesn't reproduce on Docker Desktop for macOS/Windows because its
file-sharing layer masks ownership — which is why it passes locally but fails
on the Linux CI runner.
2. `docker compose down -v` no longer gives a clean slate. Named volumes are
removed by down -v; bind-mounted host dirs are not. So the OpenSearch index,
ingestor spool, and logs persist across teardowns and have to be manually `rm
-rf`'d for a true fresh start. For an audit pipeline this also risks misleading
test runs (replayed spool events / stale indexed docs from a previous run).
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
