Rabbitmq: "Permission denied" error when starting with custom default username and password

[ArtemGordinsky]

Here's my docker-compose.yml:

rabbitmq:
  hostname: rabbitmq
  container_name: rabbitmq
  image: rabbitmq:3.6.0-management
  ports:
    - "4369:4369"
    - "5671:5671"
    - "5672:5672"
    - "25672:25672"
    - "15671:15671"
    - "15672:15672"
  volumes:
    - /var/lib/rabbitmq
  environment:
    - HOSTNAME=rabbitmq
    - RABBITMQ_NODENAME=rabbitmq
    - RABBITMQ_DEFAULT_USER=user
    - RABBITMQ_DEFAULT_PASS=password

If I run it, the following error gets written to the log and the container immediately exits:

/docker-entrypoint.sh: line 56: /etc/rabbitmq/rabbitmq.config: Permission denied

If I remove environment variables "RABBITMQ_DEFAULT_USER" and "RABBITMQ_DEFAULT_PASS", container starts normally.
Also, this is only reproducible on 3.6.0-management, everything is fine on 3.6.0.

[fox91]

+1, same issue

[lagr]

Observed the same issue @ArtemGordinsky .
I don't know whether this matters, but the error is also existent when the short tag (rabbitmq:3-management) is used. rabbitmq:3 works fine, though.

[fox91]

@lagr the issue is with the image f39b32580485.
At this time the tags 3.6.0-management, 3.6-management, 3-management and management all refer to the image f39b32580485.

[ErwinJunge]

The issue is also present in in the image with the tag rabbitmq, which has hash d6344075c9fc

[lagr]

@fox91 Thanks for the info! I will fall back to the rabbitmq:3 image then, as I am lucky enough to only need the image in a proof of concept.

[ErwinJunge]

Completely broken:

[erwin@arch-desktop ~]$ docker run -e RABBITMQ_DEFAULT_VHOST=vhost -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=password rabbitmq
/docker-entrypoint.sh: line 56: /etc/rabbitmq/rabbitmq.config: Permission denied
[erwin@arch-desktop ~]$ docker run -e RABBITMQ_DEFAULT_VHOST=vhost -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=password rabbitmq:3
/docker-entrypoint.sh: line 56: /etc/rabbitmq/rabbitmq.config: Permission denied
[erwin@arch-desktop ~]$ docker run -e RABBITMQ_DEFAULT_VHOST=vhost -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=password rabbitmq:3.6
/docker-entrypoint.sh: line 56: /etc/rabbitmq/rabbitmq.config: Permission denied
[erwin@arch-desktop ~]$ docker run -e RABBITMQ_DEFAULT_VHOST=vhost -e RABBITMQ_DEFAULT_USER=user -e RABBITMQ_DEFAULT_PASS=password rabbitmq:3.6.0
/docker-entrypoint.sh: line 56: /etc/rabbitmq/rabbitmq.config: Permission denied

It works without any environment variables set:

[erwin@arch-desktop ~]$ docker run rabbitmq

              RabbitMQ 3.6.0. Copyright (C) 2007-2015 Pivotal Software, Inc.
  ##  ##      Licensed under the MPL.  See http://www.rabbitmq.com/
  ##  ##
  ##########  Logs: tty
  ######  ##        tty
  ##########
              Starting broker...
=INFO REPORT==== 28-Jan-2016::15:53:43 ===
Starting RabbitMQ 3.6.0 on Erlang 18.2
Copyright (C) 2007-2015 Pivotal Software, Inc.
Licensed under the MPL.  See http://www.rabbitmq.com/

=INFO REPORT==== 28-Jan-2016::15:53:43 ===
node           : rabbit@b3d48f0a1cc5
home dir       : /var/lib/rabbitmq
config file(s) : /etc/rabbitmq/rabbitmq.config
cookie hash    : LmowtYqGnuEnuIKrLFOVyQ==
log            : tty
sasl log       : tty
database dir   : /var/lib/rabbitmq/mnesia/rabbit@b3d48f0a1cc5

[ErwinJunge]

rabbitmq:3.5 is unaffected, so I guess I'm falling back to that version for the time being.

[crgwbr]

+1, killed one of my staging servers

[terox]

In theory, it is fixed in tag 3.6.1 but I still experiencing issues. I can't start the container when I use some environment variable. Could someone confirm me that with rabbitmq:3.6.1-management tag all works fine?

Thank you!

[fox91]

@terox I can confirm that with rabbitmq:3.6.1-management all works fine.
Already it works with rabbitmq:3.6.0-management (image 813ab16e6e77, latest available now).

@tianon thank you!

[MrSimonEmms]

I "solved" it by adding RUN chmod 666 /etc/rabbitmq/* after adding the RabbitMQ config files. I'm using rabbitmq:3.6.9-management

[marceloavan]

The comment from @riggerthegeek is relevant if some file from original image was overwritten. I fell into the same problem because I have an image that has original as a base, but overrides some files, so the permission is overridden as well. The workaround is to apply #62 again to custom images.

[dumindu]

Same issue in rabbitmq:3.8-management-alpine as well. Quick fix is using own Docker image by extending the original image.

FROM rabbitmq:3.8-management-alpine

ADD path/to/rabbitmq.conf /etc/rabbitmq/
ADD path/to/definitions.json /etc/rabbitmq/

RUN rabbitmq-plugins enable rabbitmq_prometheus

[Kishore7298]

Still facing the issue, I'm using rabbitmq:3-management (which is 3.8-management latest).

version: '3'
services:
    rabbitmq:
        image: rabbitmq:3-management
        container_name: rabbitmq
        volumes:
            - ./.docker/rabbitmq/etc/:/etc/rabbitmq/
            - ./.docker/rabbitmq/data/:/var/lib/rabbitmq/
            - ./.docker/rabbitmq/logs/:/var/log/rabbitmq/
        environment:
            RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER}
            RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS}
        ports:
            - 5672:5672
            - 15672:15672

Error:

 /mnt/Workspace/rabbitMQ-setup  sudo docker-compose up
Starting rabbitmq ... done
Attaching to rabbitmq
rabbitmq    | touch: cannot touch '/etc/rabbitmq/rabbitmq.conf': Permission denied
rabbitmq exited with code 1

Please tell me how to fix this!

[BenTrigger]

delete this: - ./.docker/rabbitmq/etc/:/etc/rabbitmq/
it will work but without configurations

[floanwelt]

I am facing the same issue on an AWS EC2 instance with docker-compose:
rabbitmq | touch: cannot touch '/etc/rabbitmq/rabbitmq.conf': Permission denied

Any news on how to fix this?

  broker:
    restart: always
#    image: rabbitmq:3.8.3-management
    build:
      context: .
      dockerfile: Dockerfile.rabbitmq
    container_name: rabbitmq
    volumes:
      - ${PERSISTENT_DATA_PATH}rabbitmq/etc/rabbitmq:/etc/rabbitmq/:rw
      - ${PERSISTENT_DATA_PATH}rabbitmq/var/lib/rabbitmq:/var/lib/rabbitmq/:rw
      - ${PERSISTENT_DATA_PATH}rabbitmq/var/lib/rabbitmq/mnesia:/var/lib/rabbitmq/mnesia
      - ${PERSISTENT_DATA_PATH}rabbitmq/var/log/rabbitmq:/var/log/rabbitmq/:rw
    environment:
      HOSTNAME: ${RABBITMQ_HOSTNAME}
      RABBITMQ_ERLANG_COOKIE: ${RABBITMQ_ERLANG_COOKIE}
      RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER}
      RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS}
    ports:
      - ${RABBITMQ_PORT}:5672
      - ${RABBITMQ_MGT_PORT}:15672

FROM rabbitmq:3.8.3-management
#RUN bash -c "chmod 777 -R /etc/rabbitmq/"
#RUN bash -c "chown -R rabbitmq:rabbitmq /etc/rabbitmq/"
RUN chmod 666 /etc/rabbitmq/*

The uncommented lines were tries before to fix it which also did not work.

Would be eternally grateful for suggestions.

[sanjay-patel]

Still facing the issue, I'm using rabbitmq:3-management (which is 3.8-management latest).

version: '3'
services:
    rabbitmq:
        image: rabbitmq:3-management
        container_name: rabbitmq
        volumes:
            - ./.docker/rabbitmq/etc/:/etc/rabbitmq/
            - ./.docker/rabbitmq/data/:/var/lib/rabbitmq/
            - ./.docker/rabbitmq/logs/:/var/log/rabbitmq/
        environment:
            RABBITMQ_DEFAULT_USER: ${RABBITMQ_DEFAULT_USER}
            RABBITMQ_DEFAULT_PASS: ${RABBITMQ_DEFAULT_PASS}
        ports:
            - 5672:5672
            - 15672:15672

Error:

/mnt/Workspace/rabbitMQ-setup  sudo docker-compose up
Starting rabbitmq ... done
Attaching to rabbitmq
rabbitmq | touch: cannot touch '/etc/rabbitmq/rabbitmq.conf': Permission denied
rabbitmq exited with code 1
Please tell me how to fix this!

I have same issue

Creating rabbitmq ... done
Attaching to rabbitmq
rabbitmq | touch: cannot touch '/etc/rabbitmq/rabbitmq.conf': Permission denied
rabbitmq | cp: cannot stat '/etc/rabbitmq/rabbitmq.conf': No such file or directory
rabbitmq exited with code 1

[yosifkit]

@sanjay-patel, you need to give the rabbitmq container a directory it can write to in order for the current entrypoint script to generate the config file from the given environment variables. Since you are not providing your own rabbitmq.conf in that directory then you could just leave it off.

Note that we are looking to deprecate the entrypoint script in a future major release, so you may be better off not using any environment variables and just providing a conf file.

[Dzordzu]

@sanjay-patel, you need to give the rabbitmq container a directory it can write to in order for the current entrypoint script to generate the config file from the given environment variables. Since you are not providing your own rabbitmq.conf in that directory then you could just leave it off.

Note that we are looking to deprecate the entrypoint script in a future major release, so you may be better off not using any environment variables and just providing a conf file.

Just curious, but why do you want to deprecate entrypoint script? Passing env variables is (IMO) the most convenient way of providing basic data.

[tianon]

Note that we are looking to deprecate the entrypoint script in a future major release, so you may be better off not using any environment variables and just providing a conf file.

Just curious, but why do you want to deprecate entrypoint script? Passing env variables is (IMO) the most convenient way of providing basic data.

I agree that passing environment variables is convenient, but the problem is that it's a non-standard delta we've created with the stock RabbitMQ experience. If RabbitMQ is going to support environment variables, that should happen in RabbitMQ itself (not in a custom script we maintain separately).

[ailjushkin]

@tianon
Running container with selinux labels for volume mappings seems to have fixed the problem to me.
I added :z to the end of mappings and it works.

/etc/systemd/system/rabbitmq.service

[Unit]
Description=RabbitMq Service
After=podman.service
Requires=podman.service

[Service]
User=cloud-user
TimeoutStartSec=0
Restart=always
ExecStartPre=-/usr/bin/podman exec %n stop
ExecStartPre=-/usr/bin/podman rm %n
ExecStartPre=/usr/bin/podman pull rabbitmq:3.8.9-management-alpine
ExecStart=/usr/bin/podman run -u 1000 --hostname rabbitmq --rm --name %n \
    -p 5672:5672 \
    -p 15672:15672 \
    -v /opt/data/rabbitmq/db:/var/lib/rabbitmq/mnesia:z \
    -v /opt/data/rabbitmq/etc/rabbitmq:/etc/rabbitmq:z \
    rabbitmq:3.8.9-management

[Install]
WantedBy=default.target

[tianon]

I'm glad you fixed your issue, but I'd really add some extreme caution around using --privileged as you're essentially running the process with full root access to your host environment (it by design disables pretty much all the protections containers offer).

[ailjushkin]

@tianon thank you man, now I've fixed this using selinux labels. I've updated my comment above.

[wealdling]

For those still looking, copying the /etc directory to the local volume mount-point solved the issue for me. In the case of @sanjay-patel 's example compose file above:
docker cp rabbitmq:/etc/rabbitmq .docker/etc