CODEWITHSUNDEEP
docker
Remco Haszing
Remco Haszing

Reputation: 7809

Docker build failed when copying in multi step build

I get an error when using the COPY --from=reference in my Dockerfile. I created a minimal example:

FROM alpine AS build

FROM scratch
COPY --from=build / /

This causes the following build output:

$ docker build .
Sending build context to Docker daemon  2.048kB
Step 1/3 : FROM alpine AS build
 ---> b7b28af77ffe
Step 2/3 : FROM scratch
 ---> 
Step 3/3 : COPY --from=build / /
failed to copy files: failed to copy directory: Error processing tar file(exit status 1): Container ID 165578 cannot be mapped to a host ID

The builds run fine in CI, but it fails on my laptop running Ubuntu 18:04. What could be causing this issue?

Upvotes: 9

Views: 6449

Answers (3)

Richard A Quadling
Richard A Quadling

Reputation: 3988

When I wrote my answer, I was fairly new, had the same issue and found a solution. It worked, but is not the right solution.

See https://stackoverflow.com/a/75746633/2161941 for the right solution.

I'll leave my answer here purely as it was an answer, just one that's not really good enough. Educational perhaps!

=======================================================================

I've just had this issue. I wanted to copy the binaries of a standard node image to my image in a multi-stage build.

Worked fine locally. Didn't work in BitBucket Pipeline.

As mentioned by @BMitch, the issue was use of userns.

With BitBucket, the userns setting is 100000:65536, which (as I understand it) means that the "safe" userIDs must be between 100000 and 165536.

The userID you have on your source files is outside of that range, but it doesn't mean it is userID 165578. Don't ask me why, but the userID is actually 165536 lower than the value reported, so 165578 - 100000 - 65536 = 42.

The solution I have is to change the user:group ownership for the source files to root:root, copy them to my image, and set the user:group ownership back (though as I'm typing this, I've not done that bit yet as I'm not 100% it is necessary).

ARG NODE_VERSION
FROM node:${NODE_VERSION}-stretch as node

# To get the files copied to the destination image in BitBucket, we need
# to set the files owner to root as BitBucket uses userns of 100000:65536.
RUN \
    chown root:root -R /usr/local/bin && \
    chown root:root -R /usr/local/lib/node_modules && \
    chown root:root -R /opt

FROM .... # my image has a load of other things in it.

# Add node - you could also add --chown=<user>:<group> to the COPY commands if you want
COPY --from=node /usr/local/bin /usr/local/bin
COPY --from=node /usr/local/lib/node_modules /usr/local/lib/node_modules
COPY --from=node /opt /opt

Upvotes: 10

Roberto
Roberto

Reputation: 4869

I had the same issue, in my case (multi-stage dockerfile), the build was working locally but failing in the CI (bitbucket).
I solved the issue by exporting the variable export DOCKER_BUILDKIT=1.
In bitbucket-pipelines.yml add:

  
pipelines:
  default:
    - step:
        script:
          - export DOCKER_BUILDKIT=1
          - docker build --secret id=mysecret,src=mysecret.txt .
        services:
          - docker

https://bitbucket.org/blog/announcing-support-for-docker-buildkit-in-bitbucket-pipelines

Upvotes: 6

BMitch
BMitch

Reputation: 263637

That error is indicating that you have enabled userns on your Ubuntu docker host, but that there is no mapping for uid 165578. These mappings should be controlled by /etc/subuid.

Docker's userns documentation contains more examples of configuring this file.

You can also modify the source image, finding any files owned by 165578 and changing them to be within your expected range.

Upvotes: 1

Related Questions