25

I've got a Docker image which generates log-like files when errors occur. I've mounted the directory it writes to to my host machine with a bind mount. However, the created files are owned by root. Though my user account has root privileges, it is tedious to run chown and chgrp after every run of the container in order to inspect the files.

Is there a way to have the container set the owner and group of the files to that of the user who ran the container?

For some context, here's a toy example I created:

Dockerfile

FROM debian WORKDIR /root VOLUME /root/output COPY run.sh /root/ ENTRYPOINT ["./run.sh"]

run.sh

#!/bin/bash echo hello > output/dump

My execution command is

docker run -v $PWD/output:/root/output test
Improve this question
0

2 Answers 2

Reset to default
20

The files are created by the user that runs within the container. If your containerized command runs as root, then all files will be created as root.

If you want your files to be created as another user, run the container as this other user. e.g.

docker run -v "$(pwd)/output":/root/output -u $(whoami) test

Note: Depending on your container, this might not work out of the box (e.g., because, within the container, you need to open a privileged port or your script is only accessible by a given (super)user).

Improve this answer
7
  • 6
    So, I have to create a user with the same name inside the container? Otherwise, the container complains that the user could not be found in /etc/passwd. Commented Jan 1, 2021 at 0:43
  • 2
    you could also just use the (numeric) uid instead of the username. e.g. docker run -v "$(pwd)/output":/root/output -u ${UID} test Commented Jan 1, 2021 at 20:19
  • 2
    well your run.sh script lives in /root/, and /root/ is typically not readable by anyone but the superuser. Commented Jan 1, 2021 at 22:49
  • 12
    Note that -u $(whoami) requires that the user exists in the container. If that's not the case, you can use -u $(id -u):$(id -g) instead. Commented Nov 18, 2021 at 7:07
  • 1
    @Ignitor with that work around I still can't create directories inside the volume, mkdir: cannot create directory '/emacs-install-out/system-lib': Permission denied Commented Dec 21, 2021 at 22:22
6

It's an old known bug. As a workaround, one may use Podman, it is compatible with Docker, they even suggest adding an alias docker=podman. One advantage in context of the question here is that Podman does not require a service running as root. Not only it's good for security, but it actually avoids bugs like this.

Demonstration:

$ ls -l /tmp/hello ls: cannot access 'hello': No such file or directory $ podman run --rm -v /tmp/:/mnt/ -it ubuntu:22.04 sh -c "touch /mnt/hello && ls -l /mnt/hello" -rw-r--r--. 1 root root 0 Sep 26 03:57 /mnt/hello $ ls -l /tmp/hello -rw-r--r--. 1 konstantin konstantin 0 сен 26 06:57 hello
Improve this answer

You must log in to answer this question.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.