Azure Container App mounted volume - permission denied

Question

Azure Container App mounted volume - permission denied

Dejan Gjorgjevik 15

My c# .net core 5 application running in azure container environment as azure container app with azure file mounted as a persistent volume suddenly started to throw UnauthorizedAccessException (see below).

It was all working fine until recently. The azure file is setup in read/write access mode and mounts to the container without any issue. The application reads from the volume but when it tries to write only the file is created and then the exception is thrown.


System.UnauthorizedAccessException: Access to the path '/app/Card/IMPORTINTERNATIONAL/EXP_3_20231129_1.XML' is denied.
 ---> System.IO.IOException: Permission denied
   --- End of inner exception stack trace ---
   at System.IO.FileStream.WriteNative(ReadOnlySpan`1 source)
   at System.IO.FileStream.FlushWriteBuffer()
   at System.IO.FileStream.Dispose(Boolean disposing)
   at System.IO.Stream.Close()
   at System.IO.StreamWriter.CloseStreamFromDispose(Boolean disposing)
   at System.IO.StreamWriter.Dispose(Boolean disposing)
   at System.IO.TextWriter.Dispose()
   at PCES.CardService.Web.Controllers.QPCController.<>c__DisplayClass25_0.

2 answers

Your answer

Answer 1

Dejan Gjorgjevik 15

The issue has been resolved by changing the file create/update with the following code:

new FileStream(filename, FileMode.OpenOrCreate, FileAccess.Write, FileShare.None)

The problem was probably coming from the CIFS mount implementation.

MikeUrnun 9,777 Reputation points Moderator

2023-12-05T16:55:05.34+00:00

@Dejan Gjorgjevik Thanks for sharing the details of what worked. Glad to hear that the issue is resolved!
Marco Pasveer 0 Reputation points

2024-01-24T09:00:29.35+00:00
We had the same problem. This did not work: new FileStream(filename, FileMode.OpenOrCreate, FileAccess.Write, FileShare.Read) This did: new FileStream(filename, FileMode.OpenOrCreate, FileAccess.Write, FileShare.None) I do not understand why a more strict FileShare policy removes the problem. Here's the FileShare code:

public enum FileShare { // No sharing. Any request to open the file (by this process or another // process) will fail until the file is closed. None = 0, // Allows subsequent opening of the file for reading. If this flag is not // specified, any request to open the file for reading (by this process or // another process) will fail until the file is closed. Read = 1, // ... }

Code: https://github.com/microsoft/referencesource/blob/master/mscorlib/system/io/fileshare.cs

Answer 2

MikeUrnun 9,777 Moderator

Hello @Dejan Gjorgjevik - Regarding the below:

The azure file is setup in read/write access mode and mounts to the container without any issue.

Could you elaborate on how it was done? Based on our docs, as far as ACA & Azure Files are concerned for the permission side of things, all that's needed seems to be the following command:

az containerapp env storage set --name my-env --resource-group my-group \
     --storage-name mystorage \
     --azure-file-account-name <STORAGE_ACCOUNT_NAME> \
     --azure-file-account-key <STORAGE_ACCOUNT_KEY> \
     --azure-file-share-name <STORAGE_SHARE_NAME> \
     --access-mode ReadWrite

This error you're hitting is from the application not having the write permission so please verify that you've run the above, especially given how Read operations are working fine. The following CLI command should show details of your current config:

az containerapp env storage show --name
                                 --resource-group
                                 --storage-name

Also, could you provide more context on whether your app had worked fine as-is and then started throwing this error? or changes were made and the application started throwing this error?

I look forward to your reply.

Dejan Gjorgjevik 15

Dear Mike,

thanks a lot for your instructions/queries. The storage was set using the UI and not the CLI but with those parameters of course.

The application worked as-is till few days ago but just suddenly started to throw that exception on write operations recently. No changes were done on the application nor on the storage.

The result from the CLI command:

az containerapp env storage show --name
                                 --resource-group
                                 --storage-name

{
  "id": "/subscriptions/ae8e4fd2-7beb-439b-98f8-38ce6a8df8e5/resourceGroups/PCES-PROD-Baobab-RG/providers/Microsoft.App/managedEnvironments/PCES-PROD-ACA-Baobab/storages/card",
  "name": "card",
  "properties": {
    "azureFile": {
      "accessMode": "ReadWrite",
      "accountName": "pcesprodbaobabsa",
      "shareName": "card"
    }
  },
  "resourceGroup": "PCES-PROD-Baobab-RG",
  "type": "Microsoft.App/managedenvironments/storages"
}

Arnold Knott 1

I have a similar issue: I can connect the container with an Azure storage share, but as soon as I run chmod on the mounted container directory, I get Operation not permitted.

After examining the file share connector with

az containerapp env storage show --name <container_env_name>
                                 --resource-group <ressource_group_name>
                                 --storage-name <share_name_connection>

I get:

{
  "id": "/subscriptions/***/resourceGroups/***/providers/Microsoft.App/managedEnvironments/***/storages/***",
  "name": "***",
  "properties": {
    "azureFile": {
      "accessMode": "ReadWrite",
      "accountName": "***",
      "shareName": "***"
    }
  },
  "resourceGroup": "***",
  "type": "Microsoft.App/managedenvironments/storages"
}

Dejan Gjorgjevik 15 Reputation points

2023-12-05T15:17:12.97+00:00

Issue resolved by using the following approach:

new FileStream(filename, FileMode.OpenOrCreate, FileAccess.Write, FileShare.None)

Now the application works as it was working before. The reason is probably due to CIFS mount.
Arnold Knott 1 Reputation point

2023-12-05T15:24:46.3+00:00
Ok - my error is different. It’s caused by the container, I’m trying to deploy, which wants to change owner of the volume mount:

```dockerfile /bin/sh -c mkdir -p "$VOLUME" && chown -R appuser:appuser "$VOLUME" && chmod 1777 "$VOLUME"

So this one still doesn’t work - and not much I can do about it, other than not using Azure container apps. 😢
MikeUrnun 9,777 Reputation points Moderator

2023-12-05T16:57:13.09+00:00

Hi @Arnold Knott - Since the issue that you're experiencing may be of a different root cause, please consider opening a separate post.

Share via

Azure Container App mounted volume - permission denied

2 answers

Your answer