Quarkus: Running Quarkus JVM app on OpenShift requires root access (SCC)

Created on 4 Jun 2019  路  6Comments  路  Source: quarkusio/quarkus

Running Quarkus app in jvm mode on OpenShift requires root acces (configuring SCC).
App uses Narayana JTS.

2019-06-04 09:04:44,385 [-] WARN  [com.arj.ats.common] (main) ARJUNA048006: cannot create new instance of com.arjuna.ats.internal.arjuna.objectstore.ShadowNoFileLockStore: java.lang.reflect.InvocationTargetException
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at com.arjuna.common.internal.util.ClassloadingUtility.loadAndInstantiateClass(ClassloadingUtility.java:129)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.initStore(StoreManager.java:152)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.getActionStore(StoreManager.java:111)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.getRecoveryStore(StoreManager.java:68)
    at com.arjuna.ats.arjuna.recovery.ActionStatusService.<init>(ActionStatusService.java:65)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.lang.Class.newInstance(Class.java:442)
    at com.arjuna.common.internal.util.ClassloadingUtility.loadAndInstantiateClass(ClassloadingUtility.java:135)
    at com.arjuna.ats.arjuna.recovery.TransactionStatusManager.start(TransactionStatusManager.java:125)
    at com.arjuna.ats.arjuna.recovery.TransactionStatusManager.<init>(TransactionStatusManager.java:58)
    at com.arjuna.ats.arjuna.coordinator.TxControl.createTransactionStatusManager(TxControl.java:188)
    at com.arjuna.ats.arjuna.coordinator.TxControl.<clinit>(TxControl.java:264)
    at io.quarkus.narayana.jta.runtime.NarayanaJtaTemplate.setNodeName(NarayanaJtaTemplate.java:42)
    at io.quarkus.deployment.steps.NarayanaJtaProcessor$build6.deploy(Unknown Source)
    at io.quarkus.runner.ApplicationImpl1.doStart(Unknown Source)
    at io.quarkus.runtime.Application.start(Application.java:100)
    at io.quarkus.runtime.Application.run(Application.java:212)
    at io.quarkus.runner.GeneratedMain.main(Unknown Source)
Caused by: com.arjuna.ats.arjuna.exceptions.ObjectStoreException: ARJUNA012225: FileSystemStore::setupStore - cannot access root of object store: /deployments/ObjectStore/ShadowNoFileLockStore/defaultStore/
    at com.arjuna.ats.internal.arjuna.objectstore.FileSystemStore.<init>(FileSystemStore.java:633)
    at com.arjuna.ats.internal.arjuna.objectstore.ShadowingStore.<init>(ShadowingStore.java:652)
    at com.arjuna.ats.internal.arjuna.objectstore.ShadowNoFileLockStore.<init>(ShadowNoFileLockStore.java:53)
    ... 25 more
java.lang.ExceptionInInitializerError
    at io.quarkus.narayana.jta.runtime.NarayanaJtaTemplate.setNodeName(NarayanaJtaTemplate.java:42)
    at io.quarkus.deployment.steps.NarayanaJtaProcessor$build6.deploy(Unknown Source)
    at io.quarkus.runner.ApplicationImpl1.doStart(Unknown Source)
    at io.quarkus.runtime.Application.start(Application.java:100)
    at io.quarkus.runtime.Application.run(Application.java:212)
    at io.quarkus.runner.GeneratedMain.main(Unknown Source)
Caused by: java.lang.NullPointerException
    at com.arjuna.ats.arjuna.objectstore.StoreManager.initStore(StoreManager.java:159)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.getActionStore(StoreManager.java:111)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.getRecoveryStore(StoreManager.java:68)
    at com.arjuna.ats.arjuna.recovery.ActionStatusService.<init>(ActionStatusService.java:65)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.lang.Class.newInstance(Class.java:442)
    at com.arjuna.common.internal.util.ClassloadingUtility.loadAndInstantiateClass(ClassloadingUtility.java:135)
    at com.arjuna.ats.arjuna.recovery.TransactionStatusManager.start(TransactionStatusManager.java:125)
    at com.arjuna.ats.arjuna.recovery.TransactionStatusManager.<init>(TransactionStatusManager.java:58)
    at com.arjuna.ats.arjuna.coordinator.TxControl.createTransactionStatusManager(TxControl.java:188)
    at com.arjuna.ats.arjuna.coordinator.TxControl.<clinit>(TxControl.java:264)
    ... 6 more
2019-06-04 09:04:44,494 [-] INFO  [io.sma.rea.mes.ext.MediatorManager] (main) Cancel subscriptions
Exception in thread "main" java.lang.RuntimeException: Failed to start quarkus
    at io.quarkus.runner.ApplicationImpl1.doStart(Unknown Source)
    at io.quarkus.runtime.Application.start(Application.java:100)
    at io.quarkus.runtime.Application.run(Application.java:212)
    at io.quarkus.runner.GeneratedMain.main(Unknown Source)
Caused by: java.lang.ExceptionInInitializerError
    at io.quarkus.narayana.jta.runtime.NarayanaJtaTemplate.setNodeName(NarayanaJtaTemplate.java:42)
    at io.quarkus.deployment.steps.NarayanaJtaProcessor$build6.deploy(Unknown Source)
    ... 4 more
Caused by: java.lang.NullPointerException
    at com.arjuna.ats.arjuna.objectstore.StoreManager.initStore(StoreManager.java:159)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.getActionStore(StoreManager.java:111)
    at com.arjuna.ats.arjuna.objectstore.StoreManager.getRecoveryStore(StoreManager.java:68)
    at com.arjuna.ats.arjuna.recovery.ActionStatusService.<init>(ActionStatusService.java:65)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
    at java.lang.Class.newInstance(Class.java:442)
    at com.arjuna.common.internal.util.ClassloadingUtility.loadAndInstantiateClass(ClassloadingUtility.java:135)
    at com.arjuna.ats.arjuna.recovery.TransactionStatusManager.start(TransactionStatusManager.java:125)
    at com.arjuna.ats.arjuna.recovery.TransactionStatusManager.<init>(TransactionStatusManager.java:58)
    at com.arjuna.ats.arjuna.coordinator.TxControl.createTransactionStatusManager(TxControl.java:188)
    at com.arjuna.ats.arjuna.coordinator.TxControl.<clinit>(TxControl.java:264)
    ... 6 more

Setting -Dcom.arjuna.ats.arjuna.objectstore.objectStoreDir and mounting volume seems to avoid configuring SCC (witch is better).
Can we add it to documentation?

arepersistence kinquestion
Source
picture djajcevic

Most helpful comment

I figured out the same problem when using JTA.

Because OpenShift does not allow to run a docker image with root user (like fabric8 alpine image does), the docker image has to create a running user with all access rights needed.

I extended the quarkus generated Dockerfile.jvm to solve this problem by adding a quarkus user with all needed rights. 

FROM fabric8/java-alpine-openjdk8-jre
ENV JAVA_OPTIONS="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
ENV AB_ENABLED=jmx_exporter
COPY target/lib/* /deployments/lib/
COPY target/*-runner.jar /deployments/app.jar

RUN adduser -s /bin/bash -G root --no-create-home --disabled-password quarkus \
  && chown -R quarkus /deployments \
  && chmod -R "g+rwX" /deployments \
  && chown -R quarkus:root /deployments
USER quarkus

EXPOSE 8080
ENTRYPOINT [ "/deployments/run-java.sh" ]
picture haraldatbmw on 8 Oct 2019
👍3

All 6 comments

Can you please elaborate on why the application needs to run as root in the first place?

geoand picture geoand on 4 Jun 2019

What I found is that Narayana uses ShadowNoFileLockStore. The linecannot access root of object store: /deployments/ObjectStore/ShadowNoFileLockStore/defaultStore/ says it all.
I was using Dockervile.jvm from examples that uses fabric8/java-alpine-openjdk8-jre base image.

If you run it on your laptop (and you have root access) it's OK.

/deployments is a WORKING directory. Probably app does not have write access to 'root' directory. I haven't tried to change folder permissions, will try and get back at you.

djajcevic picture djajcevic on 4 Jun 2019

Can you try adding something like:

USER root
RUN chown -R jboss /deployments
USER jboss

in Dockerfile.jvm?

geoand picture geoand on 4 Jun 2019

OK, this problem is not Quarkus problem. It's Narayana's 'problem'.
It occurred on every base image with root user.
For fabric8 image, there's no jboss user but tried with nobody and it was not successful.

The only solution that worked for me was setting -Dcom.arjuna.ats.arjuna.objectstore.objectStoreDir to mounted volume.

Since this is not Quarkus problem I'll close it, but if anyone has any better idea I would be more than welcome to try it.

djajcevic picture djajcevic on 5 Jun 2019

@jfwork :+1:

FWIW, you can use fabric8/java-centos-openjdk8-jdk and then the change I suggested above should work

geoand picture geoand on 5 Jun 2019

I figured out the same problem when using JTA.

Because OpenShift does not allow to run a docker image with root user (like fabric8 alpine image does), the docker image has to create a running user with all access rights needed.

I extended the quarkus generated Dockerfile.jvm to solve this problem by adding a quarkus user with all needed rights. 

FROM fabric8/java-alpine-openjdk8-jre
ENV JAVA_OPTIONS="-Dquarkus.http.host=0.0.0.0 -Djava.util.logging.manager=org.jboss.logmanager.LogManager"
ENV AB_ENABLED=jmx_exporter
COPY target/lib/* /deployments/lib/
COPY target/*-runner.jar /deployments/app.jar

RUN adduser -s /bin/bash -G root --no-create-home --disabled-password quarkus \
  && chown -R quarkus /deployments \
  && chmod -R "g+rwX" /deployments \
  && chown -R quarkus:root /deployments
USER quarkus

EXPOSE 8080
ENTRYPOINT [ "/deployments/run-java.sh" ]
haraldatbmw picture haraldatbmw on 8 Oct 2019
👍3
Was this page helpful?
0 / 5 - 0 ratings

Related issues

rodrigofujioka picture rodrigofujioka  路  3Comments
MossabTN picture MossabTN  路  3Comments
dcdh picture dcdh  路  3Comments
halhelal picture halhelal  路  3Comments
pipinet picture pipinet  路  3Comments