Red Hat Enterprise Linux Diagnostics and Troubleshooting

Gather information about the failing application.

1. Log in to servera.

   [student@workstation ~]$ ssh student@servera
   ...output omitted...

2. Attempt to reach the application.

   The curl command returns an error.

   [student@servera ~]$ curl localhost:8080
   curl: (56) Recv failure: Connection reset by peer

3. Inspect the container service.

   [student@servera ~]$ systemctl --user status container-web.service
   
   ● container-web.service - Podman container-web.service
      Loaded: loaded (/home/student/.config/systemd/user/container-web.service; disabled; vendor preset: enabled)
      Active: active (running) since Thu 2021-11-18 14:20:01 EST; 24s ago
        Docs: man:podman-generate-systemd(1)
     Process: 34277 ExecStart=/usr/bin/podman run --conmon-pidfile /run/user/1000/container-web.pid --cidfile /run/user/1000/container-web.ctr-id --cgroups=no-conmon --replace --name web -dt -p 8080:8181 -v /var/we>
     Process: 34275 ExecStartPre=/bin/rm -f /run/user/1000/container-web.pid /run/user/1000/container-web.ctr-id (code=exited, status=0/SUCCESS)
   ...output omitted...
   Nov 18 14:20:00 serverb.lab.example.com systemd[1433]: Starting Podman container-web.service...
   Nov 18 14:20:00 serverb.lab.example.com podman[34277]: 13b5...c1d4
   Nov 18 14:20:01 serverb.lab.example.com podman[34277]: 24e6...9714
   Nov 18 14:20:01 serverb.lab.example.com systemd[1433]: Started Podman container-web.service.

4. Run the podman command to view more information about the container.

   The container is running; however, the port configuration is incorrect. The container is listening on port 8181 rather than port 8080.

   [student@servera ~]$ podman ps
   
   CONTAINER ID  IMAGE                                     COMMAND               CREATED        STATUS            PORTS                   NAMES
   24e68a162893  registry.access.redhat.com/ubi8/httpd-24  /usr/bin/run-http...  2 minutes ago  Up 2 minutes ago  0.0.0.0:8080->8181/tcp  web

Update the systemd service file to use the correct ports.

1. Modify the systemd service file so that the container listens on port 8080.

   [student@servera ~]$ vi .config/systemd/user/container-web.service

2. Verify the configuration is correct.

   [student@servera ~]$ grep -o 8080:8080 .config/systemd/user/container-web.service
   8080:8080

3. Restart the daemon and the service.

   [student@servera ~]$ systemctl --user daemon-reload
   [student@servera ~]$ systemctl --user restart container-web.service

Inspect the default page that the container returns.

1. Run the curl command.

   The output is the default Apache2 page, not the wanted output.

   [student@servera ~]$ curl localhost:8080
   ...output omitted...

Determine why the incorrect page is appearing.

1. Check the container logs.

   The required volume mount has a permission error.

   [student@servera ~]$ podman logs web
   ...output omitted...
   [Thu Nov 18 19:24:36.929545 2021] [core:error] [pid 42:tid 140513269212928] (13)Permission denied: [client 10.0.2.100:37912] AH00035: access to /index.html denied (filesystem path '/var/www/html/index.html') because search permissions are missing on a component of the path
   ...output omitted...

2. Inspect the container mounts.

   The container mounts the /var/webfiles directory from the host system.

   [student@servera ~]$ podman inspect web | grep -A 4 Mounts
           "Mounts": [
               {
                   "Type": "bind",
                   "Source": "/var/webfiles",
                   "Destination": "/var/www/html",

3. Check the permissions and SELinux contexts on the /var/webfiles directory.

   The directory's files do not have the required container_file_t context.

   [student@servera ~]$ ls -lZ /var/webfiles
   total 4
   -rw-r--r--. 1 root root unconfined_u:object_r:var_t:s0 23 Nov 18 14:19 index.html

Update the SELinux context and verify that the container returns the desired output.

1. Update the SELinux context.

   [student@servera ~]$ sudo semanage fcontext -a -t container_file_t '/var/webfiles(/.*)?'
   [sudo] password for student: student
   [student@servera ~]$ sudo restorecon -Rv /var/webfiles/
   Relabeled /var/webfiles from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:container_file_t:s0
   Relabeled /var/webfiles/index.html from unconfined_u:object_r:var_t:s0 to unconfined_u:object_r:container_file_t:s0

2. Confirm that the wanted output appears.

   [student@servera ~]$ curl localhost:8080
   hello from a container

3. Return to workstation as the student user.

   [student@servera ~]$ exit
   [student@workstation ~]$