ECS/Fargate临时存储挂载权限问题：非特权用户无法写入

我之前在ECS/EC2上运行服务一切正常，但迁移到ECS/Fargate后，临时存储的挂载目录属主变成了root:root，导致以非特权用户myuser:mygroup运行的应用无法写入该目录。但奇怪的是，EFS挂载的目录属主符合预期，没有问题。

使用Terraform创建的服务配置 #

resource "aws_ecs_task_definition" "mytask" {
  family = "mytask"
  container_definitions = templatefile("${path.module}/task-definitions/mytaskdef.json", {
    [...]
  }
  volume {
    name = "media"
    efs_volume_configuration {
      file_system_id = aws_efs_file_system.myefs.id
    }
  }
  volume {
    name = "static"
  }
  [...]
}

resource "aws_ecs_service" "myservice" {
  name = "myservice"
  cluster = aws_ecs_cluster.mycluster.id
  task_definition = aws_ecs_task_definition.mytask.arn
  [...]
}

容器定义JSON #

[
  {
    "name": "mycontainer",
    "essential": true,
    "image": "myimage",
    "user": "myuser:mygroup",
    "privileged": null,
    "mountPoints": [
      {
        "sourceVolume": "media",
        "containerPath": "/var/www/myefsmount",
        "readOnly": false
      },
      {
        "sourceVolume": "static",
        "containerPath": "/var/www/mymountpoint",
        "readOnly": false
      }
    ],
    [...]
  }
]

Fargate环境下的命令输出 #

root@ip-10-0-0-241:/app# mount | grep mymountpoint
/dev/nvme1n1 on /var/www/mymountpoint type ext4 (rw,relatime)
root@ip-10-0-0-241:/app# ls -ld /var/www/mymountpoint
drwxr-xr-x 2 root root 4096 Jul  7 16:42 /var/www/mymountpoint
root@ip-10-0-0-241:/app#

ECS/EC2环境下的命令输出（同一份基础设施代码） #

myuser@8db224841833:/app$ mount | grep mymountpoint
/dev/nvme0n1p1 on /var/www/mymountpoint type xfs (rw,noatime,attr2,inode64,noquota)
myuser@8db224841833:/app$ ls -ld /var/www/mymountpoint
drwxrwsr-x 14 myuser mygroup 210 Jul  7 13:27 /var/www/mymountpoint
myuser@8db224841833:/app$

EFS挂载目录的命令输出（符合预期） #

root@ip-10-0-0-241:/app# mount | grep torchweb_media
fs-longfsid.efs.eu-west-2.amazonaws.com:/myefsmount on /var/www/myefsmount type nfs4 (rw,relatime,vers=4.1,rsize=1048576,wsize=1048576,namlen=255,hard,noresvport,proto=tcp,timeo=600,retrans=2,sec=sys,clientaddr=10.0.0.241,local_lock=none,addr=10.0.8.149)
root@ip-10-0-0-241:/app# ls -ld /var/www/myefsmount
drwxrwsr-x 2 myuser mygroup 6144 Jun 22 08:41 /var/www/myefsmount
root@ip-10-0-0-241:/app#

疑问 #

• AWS官方文档中，关于任务定义和卷的内容没有明确说明：当不使用EFS、Docker或FSx挂载时，默认会使用临时存储，也没有说明如何指定临时挂载目录的属主为特定用户。
• 完全相同的镜像和基础设施代码，在ECS/EC2上正常，但Fargate出现问题，唯一区别是底层架构，不清楚是否遗漏了配置项。

内容的提问来源于stack exchange，提问作者Fransurbo