| Hi, I've mounted /etc/puppet:ro inside a container and the puppet's uid/gid is not sync between host and container. I just run `puppet apply` inside the container but `puppet apply` fails because it cannot adjust the ownership inside the container as the directory is mounted ro. To replicate that behavior: ``` chown 88888 /etc/puppet/ssl/certs puppet apply --debug -e 'notify{"blah":}' ls -lrthd /etc/puppet/ssl/certs ``` then /etc/puppet/ssl/certs is back to puppet uid. So the question here is why would puppet apply need to mangle with the /etc/puppet/ssl directory as it doesn't use them because it's masterless? Or I'm missing something ? It's kinda problematic in the container world where uid/gid matching is often troublesome (name mapping is not an option on the env I'm working on). Currently I bindmount /etc/puppet/ssl rw from a dummy directory from the host. Is that a security issue by any stretch of the mind in that use case ? All in all I wish we could at least tell puppet apply to not touch those files at all if it's possible. |
