[Bug] Running pulsar-shell in docker container throws exception

[mukesh154]

Search before asking

• I searched in the issues and found nothing similar.

Read release policy

• I understand that unsupported versions don't get bug fixes. I will attempt to reproduce the issue on a supported version of Pulsar client and Pulsar broker.

Version

3.2.2

Minimal reproduce step

Describe the bug

• Run below command to start pulsar into docker container:

  $ docker run -it \
  -p 6650:6650 \
  -p 8080:8080 \
  --mount source=pulsardata,target=/pulsar/data \
  --mount source=pulsarconf,target=/pulsar/conf \
  apachepulsar/pulsar:3.2.2 \
  bin/pulsar standalone
  

• The pulsar standalone service should start successfully.
• exec into the docker container with default user pulsar using below command:
  docker exec -it <container-id> /bin/sh
• Try to start the pulsar-shell with ./bin/pulsar-shell.
• It should throw below exception:

   $ ./bin/pulsar-shell
        Exception in thread "main" java.nio.file.AccessDeniedException: /home/pulsar
	        at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
	        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
	        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	        at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:397)
	        at java.base/java.nio.file.Files.createDirectory(Files.java:700)
	        at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807)
	        at java.base/java.nio.file.Files.createDirectories(Files.java:793)
	        at org.apache.pulsar.shell.PulsarShell.<init>(PulsarShell.java:160)
	        at org.apache.pulsar.shell.PulsarShell.<init>(PulsarShell.java:142)
	        at org.apache.pulsar.shell.PulsarShell.main(PulsarShell.java:215)

• Also, if we do exec into the container with root user docker exec -it -u root <container-id> /bin/sh, the pulsar-shell is working.
• The problem is: bin directory is owned by root user not the default pulsar user.

What did you expect to see?

With default pulsar user, the pulsar-shell should be opened.

What did you see instead?

• It is throwing below exception:

   $ ./bin/pulsar-shell
        Exception in thread "main" java.nio.file.AccessDeniedException: /home/pulsar
	        at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
	        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
	        at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
	        at java.base/sun.nio.fs.UnixFileSystemProvider.createDirectory(UnixFileSystemProvider.java:397)
	        at java.base/java.nio.file.Files.createDirectory(Files.java:700)
	        at java.base/java.nio.file.Files.createAndCheckIsDirectory(Files.java:807)
	        at java.base/java.nio.file.Files.createDirectories(Files.java:793)
	        at org.apache.pulsar.shell.PulsarShell.<init>(PulsarShell.java:160)
	        at org.apache.pulsar.shell.PulsarShell.<init>(PulsarShell.java:142)
	        at org.apache.pulsar.shell.PulsarShell.main(PulsarShell.java:215)

Anything else?

The issue is also reproducible on kubernetes environment.

Are you willing to submit a PR?

• I'm willing to submit a PR!

[lhotari]

The problem is caused by invalid home directory for the default "pulsar" user. This was added in #21695.

❯ docker run --rm -it apachepulsar/pulsar:3.2.2 bash -c "cat /etc/passwd|grep pulsar"
pulsar:x:10000:0::/home/pulsar:/bin/sh

One possibility would be to make a fix in PulsarShell code, to ensure that the directory is writable:

pulsar/pulsar-client-tools/src/main/java/org/apache/pulsar/shell/PulsarShell.java

Lines 212 to 214 in 434ec1b

	if (!StringUtils.isBlank(userHome) && !"?".equals(userHome)) {
	return userHome;
	}

The logic for selecting user.dir would also need logic to check that the directory is writable.

For the Pulsar docker image, the solution in PulsarShell using user.dir won't work anymore since /pulsar isn't writable by default anymore.

It's better to disable the shell history if there's no writable location? /cc @nicoloboschi

[nicoloboschi]

@lhotari I agree with you that we should check if the directory is writable instead of throwing error.

The directory is also used for storing cluster connection parameters when you create a config.

I think we can do two things (maybe both)

1. Add a WARNING log saying that "new configs and history will be lost after you close the session"
2. Create an ad-hoc directory for the docker image (/pulsar/pulsar-shell) and adjust the code to look for that directory too ("user.dir"/"pulsar-shell")

[lhotari]

I think we can do two things (maybe both)

1. Add a WARNING log saying that "new configs and history will be lost after you close the session"

yes

2. Create an ad-hoc directory for the docker image (/pulsar/pulsar-shell) and adjust the code to look for that directory too ("user.dir"/"pulsar-shell")

It's better not to have custom solutions for the docker image. In the Dockerfile, the invalid home directory should be fixed. It could point to /pulsar/data, for example.

[lhotari]

I created #22446 which will resolve the issue, however it would be useful to implement the checks to pulsar-shell as well.

[lhotari]

Fixed by #22446