Files
zhikunyao ed7c7ff0d6 fix: initialize Docker bind mount ownership (#53549)
issue: #51221
related: #49775

## What this changes

- Add a one-shot volume initializer to the CPU and GPU standalone
Compose files.
- Resolve the numeric UID/GID from the same Milvus image and migrate
`/var/lib/milvus` before the non-root server starts.
- Write a UID/GID-specific marker only after a successful recursive
migration, so large existing volumes are not scanned on every start and
interrupted migrations remain retryable.
- Prepare the bind mount in `standalone_embed.sh`, including when a
previously created container is stopped after a permission failure.
- Teach Docker deployment health checks to exclude one-shot services.
- Document the ownership and restore contract.

The initializer has no network, uses a read-only root filesystem, and
mounts only the Milvus data directory. The Milvus server continues to
run as `milvus:milvus`.

This fixes both fresh rootful-Docker installations, where Docker creates
the bind source as `root:root`, and upgrades from root-running images
with root-owned data or cache files. It avoids the ineffective
image-layer `chmod` approach from #51226 because a bind mount hides
image-layer ownership and mode.

## Compatibility

- The recursive ownership migration runs once for each image UID/GID.
- A failed or interrupted migration does not create the marker and is
retried.
- Root-running older images can still read and write the migrated files
on rollback.
- After restoring files owned by another user, remove
`.milvus-volume-owner-*` before starting Milvus to rerun migration.

## Validation

- `git diff --check`
- `bash -n scripts/standalone_embed.sh
tests/python_client/deploy/utils.sh
tests/python_client/deploy/check_healthy.sh`
- `docker compose -f deployments/docker/standalone/docker-compose.yml
config --quiet`
- `docker compose -f
deployments/docker/gpu/standalone/docker-compose.yml config --quiet`
- Verified the deployment health-count expressions return the three
long-running services.
- Simulated the existing release bump regexes and confirmed both
init/server image references and `MILVUS_IMAGE` are updated.

Container-level startup was not run locally because the Docker daemon is
unavailable; the Linux deployment CI must exercise the fresh-install and
root-owned upgrade paths.

---------

Signed-off-by: Zhikun Yao <[email protected]>
2026-09-20 10:41:32 +08:00

57 lines
1.9 KiB
Bash

#!/bin/bash
function replace_image_tag {
image_repo=$1
image_tag=$2
image_repo=${image_repo//\//\\\/}
platform='unknown'
unamestr=$(uname)
if [[ "$unamestr" == 'Linux' ]]; then
platform='Linux'
elif [[ "$unamestr" == 'Darwin' ]]; then
platform='Mac'
fi
echo "before replace: "
cat docker-compose.yml | grep milvusdb
if [[ "$platform" == "Mac" ]];
then
# for mac os
echo "replace image tag for mac start"
sed -i "" "s/milvusdb.*/${image_repo}\:${image_tag}/g" docker-compose.yml
echo "replace image tag for mac done"
else
#for linux os
sed -i "s/milvusdb.*/${image_repo}\:${image_tag}/g" docker-compose.yml
fi
echo "after replace: "
cat docker-compose.yml | grep milvusdb
}
#to check containers all running and minio is healthy
function check_healthy {
Expect=$(yq '[.services[] | select(.restart != "no")] | length' 'docker-compose.yml')
Expect_health=$(yq '.services' 'docker-compose.yml' |grep 'healthcheck'|wc -l)
cnt=$(docker compose ps | grep -E "running|Running|Up|up" | wc -l)
healthy=$(docker compose ps | grep "healthy" | wc -l)
time_cnt=0
echo "running num $cnt expect num $Expect"
echo "healthy num $healthy expect num $Expect_health"
while [[ $cnt -ne $Expect || $healthy -ne 1 ]];
do
printf "waiting all containers getting running\n"
sleep 5
let time_cnt+=5
# if time is greater than 300s, the condition still not satisfied, we regard it as a failure
if [ $time_cnt -gt 300 ];
then
printf "timeout,there are some issues with deployment!"
exit 1
fi
cnt=$(docker compose ps | grep -E "running|Running|Up|up" | wc -l)
healthy=$(docker compose ps | grep "healthy" | wc -l)
echo "running num $cnt expect num $Expect"
echo "healthy num $healthy expect num $Expect_health"
done
}