diff --git a/docs/advanced-usage/persistent-storage.md b/docs/advanced-usage/persistent-storage.md index 2ce2cee44..a9b337867 100644 --- a/docs/advanced-usage/persistent-storage.md +++ b/docs/advanced-usage/persistent-storage.md @@ -76,6 +76,8 @@ By default, permissions are set for usage with Herokuish buildpacks. These permi - This is used for apps deployed with Cloud Native Buildpacks using the `heroku/builder` builder. - `--chown packeto`: Use `2000:2000` as the folder permissions. - This is used for apps deployed with Cloud Native Buildpacks using the `cloudfoundry/cnb` or `packeto` builders. +- `--chown root`: Use `0:0` as the folder permissions. + - This is used for containers that run their processes as root, as is typical for most Dockerfile or Docker image deploys. - `--chown false`: Skips the `chown` call. Users deploying via Dockerfile will want to specify `--chown false` and manually `chown` the created directory if the user and/or group id of the runnning process in the deployed container do not correspond to any of the above options. diff --git a/plugins/storage/internal-functions b/plugins/storage/internal-functions index 58896997b..a88aa69c5 100755 --- a/plugins/storage/internal-functions +++ b/plugins/storage/internal-functions @@ -44,12 +44,19 @@ cmd-storage-ensure-directory() { CHOWN_FLAG="1000" elif [[ "$CHOWN_FLAG" == "packeto" ]]; then CHOWN_FLAG="2000" + elif [[ "$CHOWN_FLAG" == "root" ]]; then + CHOWN_FLAG="0" elif [[ "$CHOWN_FLAG" == "false" ]]; then CHOWN_FLAG="false" else dokku_log_fail "Unsupported chown permissions" fi + userns_enabled="$(docker info -f '{{range .SecurityOptions}}{{if eq . "name=userns"}}true{{end}}{{end}}')" + if [[ "$userns_enabled" == "true" ]] && [[ "$CHOWN_FLAG" != "false" ]]; then + CHOWN_FLAG=$((CHOWN_FLAG + 165536)) + fi + local storage_directory="${DOKKU_LIB_ROOT}/data/storage/$DIRECTORY" dokku_log_info1 "Ensuring ${storage_directory} exists" mkdir -p "${storage_directory}"