5 files changed, 21 insertions, 0 deletions
diff --git a/docker/nova/nova-base/Dockerfile.j2 b/docker/nova/nova-base/Dockerfile.j2
index 898dd3736..0f9aedd94 100644
--- a/docker/nova/nova-base/Dockerfile.j2
+++ b/docker/nova/nova-base/Dockerfile.j2
@@ -52,6 +52,10 @@ RUN ln -s nova-base-source/* nova \
     && cp -r /nova/etc/nova/* /etc/nova/ \
     && chown -R nova: /etc/nova /var/log/nova /home/nova /var/lib/nova
 
+COPY nova_sudoers /etc/sudoers.d/nova_sudoers
+RUN chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/nova_sudoers
+
 {% endif %}
 
 RUN usermod -a -G kolla nova
diff --git a/docker/nova/nova-base/nova_sudoers b/docker/nova/nova-base/nova_sudoers
new file mode 100644
index 000000000..6d73da6d3
--- /dev/null
+++ b/docker/nova/nova-base/nova_sudoers
@@ -0,0 +1 @@
+nova ALL = (root) NOPASSWD: /var/lib/kolla/venv/bin/nova-rootwrap /etc/nova/rootwrap.conf *
diff --git a/docker/nova/nova-compute/Dockerfile.j2 b/docker/nova/nova-compute/Dockerfile.j2
index 029a435c7..aad9c8ba8 100644
--- a/docker/nova/nova-compute/Dockerfile.j2
+++ b/docker/nova/nova-compute/Dockerfile.j2
@@ -50,6 +50,12 @@ RUN /var/lib/kolla/venv/bin/pip --no-cache-dir install --upgrade -c requirements
 
 {% endif %}
 
+COPY nova_compute_sudoers /etc/sudoers.d/nova_compute_sudoers
+COPY extend_start.sh /usr/local/bin/kolla_extend_start
+RUN chmod 755 /usr/local/bin/kolla_extend_start \
+    && chmod 750 /etc/sudoers.d \
+    && chmod 440 /etc/sudoers.d/nova_compute_sudoers
+
 {{ include_footer }}
 
 USER nova
diff --git a/docker/nova/nova-compute/extend_start.sh b/docker/nova/nova-compute/extend_start.sh
new file mode 100644
index 000000000..084e76a19
--- /dev/null
+++ b/docker/nova/nova-compute/extend_start.sh
@@ -0,0 +1,9 @@
+#!/bin/bash
+
+# Bootstrap and exit if KOLLA_BOOTSTRAP variable is set. This catches all cases
+# of the KOLLA_BOOTSTRAP variable being set, including empty.
+if [[ "${!KOLLA_BOOTSTRAP[@]}" ]]; then
+    sudo chown nova: /var/lib/nova/
+    mkdir /var/lib/nova/instances
+    exit 0
+fi
diff --git a/docker/nova/nova-compute/nova_compute_sudoers b/docker/nova/nova-compute/nova_compute_sudoers
new file mode 100644
index 000000000..a7fb7b864
--- /dev/null
+++ b/docker/nova/nova-compute/nova_compute_sudoers
@@ -0,0 +1 @@
+%kolla ALL=(root) NOPASSWD: /usr/bin/chown nova\: /var/lib/nova/, /bin/chown nova\: /var/lib/nova/