Could not write file [/usr/share/elasticsearch/config/users] bind mounted using docker-compose

[ndtreviv (Nathan Trevivian)]

Continuing the discussion from "Device or resource busy" when adding to keystore in Docker Compose:

I received a similar exception trying to execute a bin/elasticsearch-users useradd command:

Exception in thread "main" java.io.UncheckedIOException: could not write file [/usr/share/elasticsearch/config/users]
	at org.elasticsearch.xpack.security.support.SecurityFiles.writeFileAtomically(SecurityFiles.java:72)
	at org.elasticsearch.xpack.security.authc.file.FileUserPasswdStore.writeFile(FileUserPasswdStore.java:180)
	at org.elasticsearch.xpack.security.authc.file.tool.UsersTool$AddUserCommand.execute(UsersTool.java:130)
	at org.elasticsearch.cli.EnvironmentAwareCommand.execute(EnvironmentAwareCommand.java:77)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112)
	at org.elasticsearch.cli.MultiCommand.execute(MultiCommand.java:95)
	at org.elasticsearch.cli.Command.mainWithoutErrorHandling(Command.java:112)
	at org.elasticsearch.cli.Command.main(Command.java:77)
	at org.elasticsearch.xpack.security.authc.file.tool.UsersTool.main(UsersTool.java:48)
Caused by: java.nio.file.FileSystemException: /usr/share/elasticsearch/config/users11882566129646724999tmp -> /usr/share/elasticsearch/config/users: Device or resource busy
	at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:100)
	at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
	at java.base/sun.nio.fs.UnixCopyFile.move(UnixCopyFile.java:416)
	at java.base/sun.nio.fs.UnixFileSystemProvider.move(UnixFileSystemProvider.java:267)
	at java.base/java.nio.file.Files.move(Files.java:1432)
	at org.elasticsearch.xpack.security.support.SecurityFiles.writeFileAtomically(SecurityFiles.java:67)

The users file is bind-mounted into the container.
Is there a solution to this that uses docker-compose without a custom Dockerfile?

[spinscale (Alexander Reelsen)]

Have you checked if the bind mount is writable? I think that works via docker inspect on top of my head...

[ndtreviv (Nathan Trevivian)]

It seems to be...

            {
                "Type": "bind",
                "Source": "/home/ubuntu/ro-elasticsearch/users",
                "Destination": "/usr/share/elasticsearch/config/users",
                "Mode": "rw",
                "RW": true,
                "Propagation": "rprivate"
            },