Docker: mounting/sharing a single sock file? - linux

Question

I want to share php-fpm.sock between nginx and PHP. The way I've done this right now is like so:
services:
nginx:
build:
context: .
dockerfile: docker/nginx.docker
ports:
- '8080:80'
volumes:
- type: volume
source: php_fpm_sock
target: /mnt/sock
consistency: delegated
read_only: true
volume:
nocopy: true
links:
- php
php:
build:
context: .
dockerfile: docker/php.docker
links:
- mariadb
env_file: .env
volumes:
- type: volume
source: php_fpm_sock
target: /mnt/sock
consistency: delegated
read_only: false
volume:
nocopy: true
volumes:
php_fpm_sock:
i.e. I've moved the sock file from its usual location (/var/run/php5-fpm.sock) to /mnt/sock because I can't figure out how to mount a single file and I don't want to mount the whole /var/run dir.
Secondly, I've configured php-fpm as:
[www]
listen = /mnt/sock/php-fpm
;listen.owner = www-data
;listen.group = nginx
; php-fpm runs as `www-data`, nginx runs as `nginx`
listen.mode = 0664
i.e., I've given "other" full read privileges because the nginx user group doesn't exist in the php-fpm container so I don't know how else I can give permissions to just nginx.
This all feels pretty hacky. So my questions are:
How can I share just the sock file between these two containers so that I can move the sock file back to /var/run/php5-fpm.sock
How can I fix the read permissions on this file so that only nginx can read it? i.e. how can share linux user accounts across containers?
I can also add the nginx user into the php-fpm image,
RUN useradd -r -s /usr/sbin/nologin -c "Nginx service" -U nginx -u 101
And then I can set the permissions correctly. The UID must match between both images or it won't work so I've set it explicitly. If 101 had already been used for PHP I think I'd be in trouble again, so I don't love this solution either.

Answer 1

You kind of have to do it the way you show. (But mounting the volume over the PHP container's /var/run is probably fine.)
You have three big constraints here:
Mounts are mounting some external content into the container (which can be bidirectionally written to after startup), not publishing content out.
Docker mounts the volume into the container before the main container process starts, so whatever you're mounting must already exist.
The Compose dependency mechanism essentially enforces the order in which containers are created, but it won't wait for container processes to actually start.
So by the second constraint, you can't mount the PHP-FPM socket into the PHP container, because it doesn't exist yet when you're running docker-compose up. And by the third constraint, you can't mount the socket into the nginx container either, because it's not guaranteed to exist at the moment the container is created. (You can't mount single files out of named volumes either, but in theory you could work around this by bind-mounting a host directory.)
Since a container only runs a single process, there's probably nothing else in /var/run and by its nature it should be okay to hide everything there with an empty volume anyways. The only thing you might need to manually manage is a pid file.
How can I fix the read permissions on this file so that only nginx can read it? i.e. how can share linux user accounts across containers?
You need to manually ensure that the USER both containers are using have the same numeric user ID. Note that it's common (if discouraged) to run containers as root which will bypass any controls here anyways. There's no built-in way to do this.