Docker Compose部署Otel Collector时配置文件权限拒绝问题求助

问题重现 #

使用以下docker-compose.yml配置启动OpenTelemetry Collector：

otel-collector:
    image: otel/opentelemetry-collector
    command: ["--config=/etc/otel-collector-config.yaml"]
    volumes:
      - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml
    ports:
      - "1888:1888"   # pprof extension
      - "8888:8888"   # Prometheus metrics exposed by the collector
      - "8889:8889"   # Prometheus exporter metrics
      - "13133:13133" # health_check extension
      - "4317:4317"   # OTLP gRPC receiver
      - "4318:4318"   # OTLP http receiver
      - "55679:55679" # zpages extension

执行docker compose up后出现错误：

otel-collector | Error: failed to get config: cannot resolve the
configuration: cannot retrieve the configuration: unable to read the
file file:/etc/otel-collector-config.yaml: open
/etc/otel-collector-config.yaml: permission denied otel-collector |
2022/01/09 11:15:47 collector server run finished with error: failed
to get config: cannot resolve the configuration: cannot retrieve the
configuration: unable to read the file
file:/etc/otel-collector-config.yaml: open
/etc/otel-collector-config.yaml: permission denied

解决方案 #

该错误源于容器内用户无权限读取挂载的配置文件，可通过以下方式解决：

• 修改本地配置文件权限
  给本地的otel-collector-config.yaml添加其他用户的读取权限，让容器内用户能够访问：

  chmod o+r ./otel-collector-config.yaml
  

• 以root用户运行容器
  在docker-compose.yml中添加user: root配置，让容器以root身份启动，获取文件读取权限：

  otel-collector:
      image: otel/opentelemetry-collector
      user: root  # 添加此行
      command: ["--config=/etc/otel-collector-config.yaml"]
      volumes:
        - ./otel-collector-config.yaml:/etc/otel-collector-config.yaml
      ports:
        - "1888:1888"   # pprof extension
        - "8888:8888"   # Prometheus metrics exposed by the collector
        - "8889:8889"   # Prometheus exporter metrics
        - "13133:13133" # health_check extension
        - "4317:4317"   # OTLP gRPC receiver
        - "4318:4318"   # OTLP http receiver
        - "55679:55679" # zpages extension
  

• 调整挂载方式或使用命名卷
  若不想修改权限或使用root用户，可采用绑定挂载时指定只读权限，或者将配置文件复制到命名卷中；生产环境更推荐构建自定义镜像，将配置文件内置到镜像内。

内容的提问来源于stack exchange，提问作者Jonio