How to Install s3fs to access s3 bucket from Docker container

1. We start from the second layer, by inheriting from the first FROM envs as dist.
2. Install s3fs apt install s3fs -y. If you wish to choose different base image which is a different OS, please make sure to install s3fs for that specific OS. To install s3fs for desired OS, follow the official installation guide.
3. Next we need to add one single line in /etc/fstab to enable s3fs mount work;

"s3fs#${BUCKET_NAME} ${OPERATOR_HOME}/s3_bucket fuse _netdev,allow_other,nonempty,umask=000,uid=${OPERATOR_UID},gid=${OPERATOR_UID},passwd_file=${OPERATOR_HOME}/.s3fs-creds,use_cache=/tmp,url=${S3_ENDPOINT} 0 0"

• Our mount location is ${OPERATOR_HOME}/s3_bucket
• addition configs for s3fs to allow non-root user to allow read/write on this mount location `allow_others,umask=000,uid=${OPERATOR_UID}`
• we ask s3fs to look for secret credentials on file .s3fs-creds by `passwd_file=${OPERATOR_HOME}/.s3fs-creds`

4. And the final bit left is to un-comment a line on fuse configs to allow non-root users to access mounted directories

sed -i '/user_allow_other/s/^#//g' /etc/fuse.conf

Switch to operator user

# Set our user to the operator user
USER ${OPERATOR_USER}
WORKDIR ${OPERATOR_HOME}
COPY main.py .

Change user to operator user and set the default working directory as ${OPERATOR_HOME} which is /home/op. Here is your chance to import all your business logic code from host machine into the docker container image. In our case, we just have a single python file main.py.

Run-time configs

RUN printf '#!/usr/bin/env bash  \n\
mkdir ${OPERATOR_HOME}/s3_bucket \n\
echo ${ACCESS_KEY_ID}:${SECRET_ACCESS_KEY} > ${OPERATOR_HOME}/.s3fs-creds \n\
chmod 400 ${OPERATOR_HOME}/.s3fs-creds \n\
mount -a \n\
exec python ${OPERATOR_HOME}/main.py \
' >> ${OPERATOR_HOME}/entrypoint.sh

After setting up the s3fs configurations, its time to actually mount s3 bucket as file system in given mount location. We are going to do this at run time e.g. after building the image with docker runcommand. A bunch of commands needs to run at the container startup, which we packed inside an inline entrypoint.sh file, explained follows;

• firstly, we create .s3fs-creds file which will be used by s3fs to access s3 bucket. The content of this file is as simple as <access_key_id>:<secret_access_key>
• give read permissions to the credential file chmod 400
• create the directory where we ask s3fs to mount s3 bucket to
• finally mount the s3 bucket mount -a. If this line runs without any error, that means s3fs has successfully mounted your s3 bucket
• next, feel free to play around and test the mounted path. In our case, we run a python script to test if mount was successful and list directories inside s3 bucket.
• give executable permission to this entrypoint.sh file
• set ENTRYPOINT pointing towards the entrypoint bash script

Time to see s3fs in action!

Build the image;

docker build . -t s3fs_mount --build-arg BUCKET_NAME=<your-bucket-name>

Output;

. . . 
> [2/2] COMMIT s3fs_mount 
> --> 575382adfa1 
> Successfully tagged localhost/s3fs_mount:latest

run the image with privileged access. Here pass in your IAM user key pair as environment variables <access_key_id> and <secret_access_key>

docker run -it -e ACCESS_KEY_ID=<access_key_id> -e SECRET_ACCESS_KEY=<secret_access_key> --privileged localhost/s3fs_mount:latest

Output:

s3fs-mount % podman run --privileged -e ACCESS_KEY_ID=AKIA5RUBBISHUWBOY -e SECRET_ACCESS_KEY=OuvzUjigtHisIsNotWhaTyOuThINkL+EsNs8U7B localhost/s3fs_mount:latest Checking mount status bucket mounted successfully :) list s3 directories ['foo']

If everything works fine, you should see an output similar to above. This lines are generated from our python script, where we are checking if mount is successful and then listing objects from s3.

import os

if __name__ == "__main__":
    print('Checking mount status')
    if os.path.ismount(f"s3_bucket/"):
        print(f"bucket mounted successfully :)")
    else:
        print(f"bucket not mounted :(")
    print("list s3 directories")
    print(os.listdir(f"s3_bucket/"))

You can also go ahead and try creating files and directories from within your container and this should reflect in s3 bucket. Do this by overwriting the entrypoint;

anum_sheraz@YHGFX6RHVJ s3fs-mount % podman run -it --privileged -e ACCESS_KEY_ID=AKIA5RUBBISHUWBOY -e SECRET_ACCESS_KEY=tHisIsNotWhaTyOuThINkL+EsNdreZNfZOs8U7B --entrypoint /bin/bash localhost/s3fs_mount:latest op@ca238738054f:~$ mkdir ${OPERATOR_HOME}/s3_bucket op@ca238738054f:~$ echo ${ACCESS_KEY_ID}:${SECRET_ACCESS_KEY} > ${OPERATOR_HOME}/.s3fs-creds op@ca238738054f:~$ chmod 400 ${OPERATOR_HOME}/.s3fs-creds op@ca238738054f:~$ mount -a op@ca238738054f:~$ ls s3_bucket/ foo op@ca238738054f:~$ touch s3_bucket/my-new-file op@ca238738054f:~$ ls s3_bucket/ foo my-new-file

Now head over to the s3 console. After refreshing the page, you should see the new file in s3 bucket.

Things never work on first try. So here are list of problems/issues (with some possible resolutions), that you could face while installing s3fs to access s3 bucket on docker container;

1. Transport endpoint is not connected: ‘s3_bucket/’

This error message is not at all descriptive and hence its hard to tell whats exactly is causing this issue. There can be multiple causes for this. Try following;

• Make sure you are using the correct credentails key pair.
• Make sure your s3 bucket name is correctly following aws standards.
• Sometimes s3fs fails to establish connection at first try, and fails silently while typing mount -a. Try increasing the retries on s3fs command by adding following option `-o retries=10` in in /etf/fstab file.
• Sometimes the mounted directory is being left mounted due to a crash of your filesystem. In that case, try force unounting the path and mounting again.

fuzermount -uf /home/op/s3_bucket 
mount /home/op/s3_bucket

2. Can’t access encrypted s3 bucket

If your bucket is encrypted, use sefs option `-o use_sse` in s3fs command inside /etc/fstab file. Possible values are SSE-S3, SSE-C or SSE-KMS. s33 more details about these options in s3fs manual docs.

3. s3fs: command not found

This is obviously because you didn’t managed to Install s3fs and accessing s3 bucket will fail in that case. Check and verify the step `apt install s3fs -y` ran successfully without any error. This could also be because of the fact, you may have changed base image that’s using different operating system. Current Dockerfile uses python:3.8-slim as base image, which is Debian. if the base image you choose has different OS, then make sure to change the installation procedure in Dockerfile apt install s3fs -y. To install s3fs for desired OS, follow the official installation guide.