# Volume mapped filebeat.yml permissions from Docker on Windows host

**URL:** <https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893>\
**Category:** Beats\
**Tags:** filebeat\
**Created:** [July 5, 2017, 11:58am UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893 "2017-07-05T11:58:19Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![NathanBaulch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathanbaulch/32/19785_2.png) [@NathanBaulch](https://discuss.elastic.co/u/NathanBaulch)\
**Post date:** [July 5, 2017, 11:58am UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893/1 "2017-07-05T11:58:19Z")

</div>

I'm trying to run the official 5.4.3 filebeat docker container via VirtualBox on a Windows host. Rather than creating a custom image, I'm using a volume mapping to pass the `filebeat.yml` file to the container using the automatically created VirtualBox mount `/c/Users` which points to `C:\Users` on my host.

Unfortunately I'm stuck on this error:

```auto
Exiting: error loading config file: config file ("filebeat.yml") can only be writable by the owner but the permissions are "-rwxrwxrwx" (to fix the permissions use: 'chmod go-w /usr/share/filebeat/filebeat.yml')

```

My docker-compose config is:

```auto
filebeat:
  image: "docker.elastic.co/beats/filebeat:5.4.3"
  volumes:
   - "/c/Users/Nathan/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
   - "/c/Users/Nathan/log:/mnt/log:ro"

```

I've tried SSH-ing into the machine and running the `chmod go-w` command but no change. Is this some kind of permission limitation when working with VirtualBox shared folders on a Windows host?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 5, 2017, 3:07pm UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893/2 "2017-07-05T15:07:03Z")

</div>

I think this is an issue with the shared filesystem since windows uses a DACL for permissions.

Please modify the command you're are using to start the container to include the flag to [disable the permission checking](https://www.elastic.co/guide/en/beats/libbeat/5.4/config-file-permissions.html#_disabling_strict_permission_checks).

```auto
filebeat:
  image: "docker.elastic.co/beats/filebeat:5.4.3"
  command: filebeat -e -strict.perms=false
  volumes:
   - "/c/Users/Nathan/filebeat.yml:/usr/share/filebeat/filebeat.yml:ro"
   - "/c/Users/Nathan/log:/mnt/log:ro"

```

---

<div class="post-metadata">

**Author:** ![NathanBaulch](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/nathanbaulch/32/19785_2.png) [@NathanBaulch](https://discuss.elastic.co/u/NathanBaulch)\
**Post date:** [July 5, 2017, 3:23pm UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893/3 "2017-07-05T15:23:54Z")

</div>

Thanks Andrew. How does the `command` property differ from `entrypoint`?

---

<div class="post-metadata">

**Author:** ![andrewkroh](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/andrewkroh/32/3784_2.png) [@andrewkroh](https://discuss.elastic.co/u/andrewkroh)\
**Post date:** [July 5, 2017, 3:44pm UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893/4 "2017-07-05T15:44:17Z")

</div>

At the current time I believe the Elastic Beats images [all use](https://github.com/elastic/beats-docker/blob/master/templates/Dockerfile.j2#L42) `CMD` rather than `ENTRYPOINT`. There are some subtle differences in how your override the command that is executed inside the container based on whether the image uses a command or an entrypoint. When the image uses an entrypoint, the command is appended to the entrypoint. When an image uses a command, then specifying a new command completely overwrites the command in the image.

So if our images were to specify an entrypoint (they don't) of `metricbeat -e` then you could just specify `command: -strict.perms=false` and it would run `metricbeat -e -strict.perms=false` inside the container. But because the image uses a `CMD` in the Dockerfile you need to specify the complete command that you want to run if you need to change it.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [August 2, 2017, 3:44pm UTC](https://discuss.elastic.co/t/volume-mapped-filebeat-yml-permissions-from-docker-on-windows-host/91893/5 "2017-08-02T15:44:48Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.