What is the best way to run a command in the offen/docker-volume-backup container before creating a backup?

[ottobolyos]

I am using using timescale/timescaledb-ha which runs PostgreSQL and all related commands as postgres user which has UID/GID set to 1000 (it is a non-root, non-system user). This causes an issue, as docker-volume-backup runs all commands are root , therefore everytime it creates a backup, the files are root-owned and pg_dumpall cannot access/overwrite the files in a subsequent backup.

Now, this can be easily worked around by running chown -R 1000:1000 /backup in the docker-volume-backup container before actually creating the backup. However, what is the best way to accomplish this?

Note that ATM I am using offen/docker-volume-backup:v2.25.1 (set up by a former colleague) and I use the backup label on the database container to defined the backup command:

"docker-volume-backup.exec-pre=/bin/sh -c 'pg_dumpall -U $PGUSER --clean --file /home/postgres/pgdata/backup/dumpall.sql'"

As that docker-volume-backup version still uses external cron, I could bind-mount /var/spool/cron/crontabs/root and change the ownership of /backup before running backup (i.e. 0 1 * * * chown -R 1000:1000 /backup && backup 2>&1), I’d like to have a kind of confirmation if this will work and is the best solution from your PoV.

Thank you in advance! 🙏

[m90]

Is there anything that keeps you from updating the Image version? Newer versions support running as non-root https://offen.github.io/docker-volume-backup/how-tos/use-as-non-root.html

[m90]

Commands are run in the container that the respective label is applied to. If you label your postgres service, command will be run there, if you label the backup service, commands will be run in this context.

[ottobolyos]

I was wrong, indeed the backup fails:

time=2024-12-13T10:02:40.802Z level=INFO msg="Running docker-volume-backup.archive-pre command /bin/sh -c 'chown -R 1000:1000 /backup && pg_dumpall -U postgres --clean --file /home/postgres/pgdata/backup/dumpall.sql'\" for container postgres"
panic: runtime error: index out of range [0] with length 0

goroutine 21 [running]:
main.(*script).exec(0xc0003fb080, {0xc000040080, 0x40}, {0xc0000bc000?, 0xc00041c1a0?}, {0x0, 0x0})
        /app/cmd/backup/exec.go:32 +0xecc
main.(*script).runLabeledCommands.func1()
        /app/cmd/backup/exec.go:170 +0x3a9
golang.org/x/sync/errgroup.(*Group).Go.func1()
        /go/pkg/mod/golang.org/x/sync@v0.8.0/errgroup/errgroup.go:78 +0x56
created by golang.org/x/sync/errgroup.(*Group).Go in goroutine 1
        /go/pkg/mod/golang.org/x/sync@v0.8.0/errgroup/errgroup.go:75 +0x96

I cannot run chown on root-owned files as a non-root user. I have to execute the chown command in the backup container on the /backup folder, otherwise I need to downgrade to a version of your image which still uses cron and change the cronjob to 0 1 * * * chown -R 1000:1000 /backup && backup 2>&1 which would work as expected.

Ideally, I wish there would be a label where I could place a command which should be run before creating a backup, but which would be executed in the backup container, e.g. docker-volume-backup.init-pre and maybe docker-volume-backup.init-post.

Alternatively, you could add an env var to change the ownership of the /backup folder, e.g. BACKUP_OWNERSHIP='1000:1000':

• if set, must contain two integers separated by a colon (^[0-9]+:[0-9]+$) and it’ll be used in the chown command (i.e. chown -R "$BACKUP_OWNERSHIP" /backup);
• else (the env var is not set or set to an invalid value) the command will not be executed.

[m90]

Ideally, I wish there would be a label where I could place a command which should be run before creating a backup, but which would be executed in the backup container,

Again, commands will be run in the container that is labeled accordingly. If you put the label on the backup container, the command will be run there. You can also use archive-pre which will run before the tar file is created. Also note that for each command, you can specify the user that is executing the command: https://offen.github.io/docker-volume-backup/how-tos/run-custom-commands.html

[ottobolyos]

Will there not be a race condition? If chown is executed once before a backup is created, and after the following scheduled backup, the second backup would fail. chown command must be executed either always before backup (preferred) or always after backup to make sure the ownership is configured correctly.

I as understand it, moving chown to the backup container will not make sure the order of the two commands (chown and pg_dumpall).

That said, I’ll try it out later today.

docker-volume-backup.archive-pre.user

I read the docs for this, however, as I understand it, this configures which user users the command in the DB container. That is not an issue. The issue is that the ownership changes to root:root in the backup container (as I use a backup Docker volume shared between the two containers).

[ottobolyos]

It looks like it works as expected, however, I still presume there might be some race condition. 🤔

time=2024-12-18T07:46:18.367Z level=INFO msg="Running docker-volume-backup.archive-pre command /bin/sh -c 'chown -R 1000:1000 /backup' for container backup"
time=2024-12-18T07:46:18.367Z level=INFO msg="Running docker-volume-backup.archive-pre command /bin/sh -c 'pg_dumpall -U postgres --clean --file /home/postgres/pgdata/backup/dumpall.sql' for container postgres"
time=2024-12-18T07:46:20.634Z level=INFO msg="Created backup of `/backup` at `/tmp/backup-2024-12-18T07-46-18.tar.gz`."
time=2024-12-18T07:46:20.651Z level=INFO msg="Stored copy of backup `/tmp/backup-2024-12-18T07-46-18.tar.gz` in `/archive`." storage=Local
time=2024-12-18T07:46:22.748Z level=INFO msg="Uploaded a copy of backup `/tmp/backup-2024-12-18T07-46-18.tar.gz` to bucket `ladder99`." storage=S3
time=2024-12-18T07:46:22.754Z level=INFO msg="Pruned 5 out of 6 backups as they were older than the given deadline of 2024-12-15T07:47:22.751777938Z." storage=Local
time=2024-12-18T07:46:22.940Z level=INFO msg="Pruned 5 out of 6 backups as they were older than the given deadline of 2024-12-15T07:47:22.751777938Z." storage=S3
time=2024-12-18T07:46:22.943Z level=INFO msg="Removed tar file `/tmp/backup-2024-12-18T07-46-18.tar.gz`."