CODEWITHSUNDEEP
linuxdockerpermissionscontainersvirtualization
pp35377
pp35377

Reputation: 173

Docker "permission denied" in container

I am trying to run a docker image by

docker run  -it -v $PWD/examples:/home/user/examples image

which should make $PWD/examples in the host accessible in the container. However when I ls in the container, it keeps giving me

ls: cannot access 'examples': Permission denied

I have tried the answers for similar questions, the z/Z option and chcon -Rt svirt_sandbox_file_t /host/path/ and run --privileged, but neither of them have any effect in my case. In fact, the z option appears to work for the first time ls, but when I issue ls the second time it is denied again.

Upvotes: 5

Views: 29642

Answers (2)

Willie Cheng
Willie Cheng

Reputation: 8253

Try running the container as privileged:

sudo docker run --privileged=true -itd -v /***/***:/***  ubuntu bash

for example: sudo docker run --privileged=true -itd -v /home/willie:/wille ubuntu bash

Upvotes: 2

mviereck
mviereck

Reputation: 1399

In the comments it turned out that there is probably a USER instruction in the Dockerfile of the image. This user is not allowed to access examples due to file access permissions of examples.

It is possible to supersede USER with docker run option --user.

A quick and dirty solution is to run with --user=root to allow arbitrary access. Be aware that files written as root in container to folder examples will be owned by root.

A better solution is to look for owner of examples, call him foo. Specify its user id and group id to have exactly the same user in container:

docker run --user $(id -u foo):$(id -g foo)  imagename

Another possible solution is to allow arbitray access with chmod 666 examples or chmod 644 examples, but most probably you don't want that.

The best way would be to look at the Dockerfile and check the purpose of USER instruction.

  • If it only serves the purpose of avoiding root in container, the best way is to use --user=foo or more precisely --user=$(id -u foo):$(id -g foo).
  • If something in Dockerfile/image relies on specific USER, it may be the best to change access permissions of examples.
  • If you have access to the Dockerfile, you may adjust it to fit your host user/the owner of examples.

Upvotes: 5

Related Questions