Confluence failes to launch after upgrade from 6.15.6 to 6.15.8 [Docker]
Asked by Daniel Hilgarth:

I just got the security bulletin that says I should upgrade to Docker 6.15.8. I was using 6.15.6 and everything was running smoothly.

I changed my Docker compose file to use the 6.15.8 image and got this error:

```
BootstrapException: Unable to bootstrap application: failed to find config at: /var/atlassian/application-data/confluence/confluence.cfg.xml
```

I have a volume that is bound to **/var/atlassian/application-data/confluence**, so it should reuse the existing file. And indeed, the file exists.

Changing the docker compose file back to using the 6.15.6 shows that the file is indeed still there and correct. Confluence starts up without issues.

It seems to be a permission error. Executing **docker exec docker_confluence_1 ls -liash /var/atlassian/application-data/confluence** shows that all files are owned by **daemon**.

For testing purposes I executed **docker exec docker_confluence_1 chmod 777 /var/atlassian/application-data/confluence/confluence.cfg.xml** and restarted the container. Checking the owner again, I notice that it is now owned by **confluence**.

So, I execute

```
docker exec docker_confluence_1 chown -R confluence /var/atlassian/application-data/confluence/
docker exec docker_confluence_1 chgrp -R confluence /var/atlassian/application-data/confluence/
```

and restart the container.

This seems to fix it.

++My question is++: Is my fix correct?

And: Did you guys really introduce a breaking change in a PATCH release and didn't even document it? :-(


Answers:
author: Daniel Hilgarth
body: As already noted in my initial post, the fix was to change the ownership and group membership of the /var/atlassian/application-data/confluence/ folder to confluence.

As I had a named volume, I executed the permission changes in the container, not on the host system:

```
docker exec docker_confluence_1 chown -R confluence /var/atlassian/application-data/confluence/
docker exec docker_confluence_1 chgrp -R confluence /var/atlassian/application-data/confluence/
```


author: Spunkie
body: I ran into the same trouble, and ya it's a permission issue. Here's my community post about it: <https://community.atlassian.com/t5/Confluence-questions/Issue-when-upgrading-docker-confluence-from-6-15-7-to-6-15-8/qaq-p/1166542>

A change made earlier this month switched from running the confluence appdata dir under the built in **deamon** user, to creating a new **confluence** user with uid:gid of **2002:2002** during startup and running under that. Also I'm pretty sure the confluence docker image used to always run a chown on the **/var/atlassian/application-data/confluence/**dir during startup to prevent issues like this but I guess that isn't working or has been removed.

Here is the specific change: <https://bitbucket.org/atlassian-docker/docker-atlassian-confluence-server/commits/00d24164db7d667f03c9d1adefeffaf81984a6ad>

I don't imagine you would want to change the actual permission of the files like in your fix, it could definitely be a security issue running everything with 777.

I ended up just running chown on the host system to change the permission of the persistent volume before starting up confluence **6.15.8** . I'm not sure where you have placed your persistent volume on your host but mine is mounted under **/home/ec2-user/confluence/** so I ran the following cmd for a fix:

```
sudo chown -R 2002:2002 /home/ec2-user/confluence/
```

After which I can start docker like normal and confluence 6.15.8 now works with previously created persistent volumes.

comments: author: Daniel Hilgarth
body: My fix was not to change the permission to 777. It was a test to see what Confluence would make of it.

As noted in my post, the real fix is calling chown and chgrp on that folder.


author: Spunkie
body: Oh yup sorry, thanks for point that out. I completely missed that your cmds weren't chmod.


author: Spunkie
body: I ran into the same trouble, and ya it's a permission issue. Here's my community post about it: <https://community.atlassian.com/t5/Confluence-questions/Issue-when-upgrading-docker-confluence-from-6-15-7-to-6-15-8/qaq-p/1166542>

A change made earlier this month switched from running the confluence appdata dir under the built in **deamon** user, to creating a new **confluence** user with uid:gid of **2002:2002** during startup and running under that. Also I'm pretty sure the confluence docker image used to always run a chown on the **/var/atlassian/application-data/confluence/**dir during startup to prevent issues like this but I guess that isn't working or has been removed.

Here is the specific change: <https://bitbucket.org/atlassian-docker/docker-atlassian-confluence-server/commits/00d24164db7d667f03c9d1adefeffaf81984a6ad>

I don't imagine you would want to change the actual permission of the files like in your fix, it could definitely be a security issue running everything with 777.

I ended up just running chown on the host system to change the permission of the persistent volume before starting up confluence **6.15.8** . I'm not sure where you have placed your persistent volume on your host but mine is mounted under **/home/ec2-user/confluence/** so I ran the following cmd for a fix:

```
sudo chown -R 2002:2002 /home/ec2-user/confluence/
```

After which I can start docker like normal and confluence 6.15.8 now works with previously created persistent volumes.


Tags: confluence-server

cve-2019-3394

docker

server