Permission denied in mounted docker volumes

Question

I've been playing around with Docker for a while and always having a permission issue with my mounted volumes.

In fact, when I run my image in a Docker container using docker-compose, my volumes inherit the owner from the container and it becomes root:root, so I cannot edit or copy my volumes to another location.

Can anyone please tell me if there is any docker way to solve this issue?

Answer 1

• You can put a user directive in the docker-compose file (same as docker run --user someuser ...) to make the container process assume the id/group of an existing host user.

• You can also set the umask in the container to make the created files group or world readable/writable (whether you run as root or not, but it is always a good idea to not run as root).

• You can consider building the image to run with a different USER (ie, add a USER statement in your Dockerfile). The name of this user is unimportant, but you normally make the numeric ID match an ID on the host, so that all files created by the container process are owned by that ID. On the host side they will appear to be owned by the userid with the same numeric ID. If you want to be fancy you can do the same with the group.

Answer 2

For the special case where you want to share a base image between production/development without rebuilding it on every machine with a new developer user ID/GID, see the article Running Docker Containers as Current Host User - Juan Treminio. To summarize, recreate your internal docker user in a new Dockerfile:

FROM jtreminio/php:7.2

ARG USER_ID
ARG GROUP_ID

RUN if [ ${USER_ID:-0} -ne 0 ] && [ ${GROUP_ID:-0} -ne 0 ]; then \
    userdel -f www-data &&\
    if getent group www-data ; then groupdel www-data; fi &&\
    groupadd -g ${GROUP_ID} www-data &&\
    useradd -l -u ${USER_ID} -g www-data www-data &&\
    install -d -m 0755 -o www-data -g www-data /home/www-data &&\
    chown --changes --silent --no-dereference --recursive \
          --from=33:33 ${USER_ID}:${GROUP_ID} \
        /home/www-data \
        /.composer \
        /var/run/php-fpm \
        /var/lib/php/sessions \
;fi
        
USER www-data

For the even more special case where you've limited the creation of any of the internal docker user's files to the home directory, you can let usermod do the chown operation for you. From the usermod man page:

-u, --uid UID

The new numerical value of the user's ID.

...

The user's mailbox, and any files which the user owns and which are located in the user's home directory will have the file user ID changed automatically.

The ownership of files outside of the user's home directory must be fixed manually.

Juan's solution then simplifies to something like:

USER root
ARG HOST_ID="1000"
ARG HOST_GID="1000"
RUN if [ $HOST_ID -ne $USER_ID ] || [ $HOST_GID -ne $USER_GID ]; then \
    groupadd --gid "$HOST_GID" "host_user_group" &&\
    usermod --uid "$HOST_ID" --gid "$HOST_GID" "$UNAME"\
;fi
USER $UNAME