docker-node: Permissions error - after declaring USER and WORKDIR

Just do this and call it a day lol

 RUN sudo chmod -R 777 /home/node/app

F it lol…just run that before and after npm install and you should be g2g. Even better, do this:

 RUN sudo chmod -R 777 /home/node

This has been a nightmare for me… Can this be documented as what the Best Practice is suggesting to use USER node but doesn’t provide a viable config?

@albertoantunes You are right, it worked for me. Here is my Dockerfile, hope it helps some with the same problem.

FROM node:8
USER node
ENV NPM_CONFIG_PREFIX=/home/node/.npm-global
ENV PATH=$PATH:/home/node/.npm-global/bin
WORKDIR /home/node
COPY package.json .
RUN npm install --only=prod
COPY . .

@ORESoftware i believe this issue happens because only the /home/node directory is owned by the node user in the default node image. The /app directory is created and owned by root. If you change the WORKDIR to /home/node it should work.

@ORESoftware I had the same issue, you can specify the user with the COPY command. See my Dockerfile:

FROM node:latest
USER node

ARG APP=app
ARG HOME=/home/node

ENV NPM_CONFIG_PREFIX=$HOME/.npm-global
ENV PATH=$PATH:$HOME/.npm-global/bin

COPY --chown=node:node ./$APP/package*.json $HOME/$APP/

The COPY is done by default with root (source):

All new files and directories are created with a UID and GID of 0, unless the optional --chown flag specifies a given username, groupname, or UID/GID combination to request specific ownership of the copied content.

Note that COPY --chown won’t work with all docker versions (see here). Mine is 18.03.1-ce.

Correct me if I’m wrong. The doc is recommending us to declare user as node because Docker runs container as root by default.

So you declare it at the end

FROM node:9
WORKDIR /home/node/app
COPY package.json .
RUN npm install --loglevel=warn;
USER node

If I remember correctly, folder created by WORKDIR are owned by root even if they are created after the USER directive. Try creating the folder first

This worked for me. A combination of using the existing /home/node dir to host the app files and specifying the user and group for the COPY commands.

FROM node:12.10.0-slim

USER node
RUN mkdir -p /home/node/app
WORKDIR /home/node/app

COPY --chown=node:node package.json .
COPY --chown=node:node yarn.lock .

RUN yarn --pure-lockfile

COPY --chown=node:node . .

EXPOSE 4040

CMD [ "node", "index.js" ]

I had the same issue and here’s my Dockerfile. This fixed it

#Choose the base image for the build
FROM node:8-alpine
RUN mkdir -p /home/node/app && chown -R node:node /home/node/app
WORKDIR /home/node/app
COPY package*.json ./
USER node
RUN npm install
COPY --chown=node:node . .
RUN ["chmod", "755", "your-script.sh"]
EXPOSE 4140
CMD [ "node", "index.js" ]

The trick was to use

RUN ["chmod", "755", "your-script.sh"]

@abhaykumar01234 , the basic problem is that your container is using a user (in this case node, I believe) which does not map (see below) onto a user in the host that has permission to write to the directory you mounted. You get an error because the npm install writes to that directory but the user in the host doesn’t have permission.

It helps to understand what “map” means here: When a Docker container is run, the users inside the container are also interpreted as users in the host. The identity of the host user is determined by the numeric user id of the user inside the container.

• In the simplest case, which is to say without something called “user namespace mapping”, the numeric id in the host is the same as the numeric id in the container. So user 0 (root) in the container maps to user 0 (root, yikes, danger!) in the host. User 1001 in the container maps to user 1001 in the host. And so on.
• When user namespace mapping is set up in your Docker daemon, then the numeric id of a container user is mapped to a different numeric user id in the host. The mechanism is a little obscure and confusing, but that’s the essence of it. See Isolate containers with a user namespace.

All solutions to this problem involve ensuring that the user inside the container maps onto a suitable user on the host. This can be done in several ways.

The simplest way is to define and use a user in the image (i.e., in the Dockerfile) whose numeric user id is the same as a host user with suitable permissions (e.g., your own user id). This is not very flexible because the user id is fixed, but if you don’t need that flexibility, it’s effective.

A more flexible way to do much the same thing is to specify a user id externally when you build your image. There’s some good advice on this in Avoiding Permission Issues With Docker-Created Files.

A more complex but fully flexible solution to the problem is to use Docker’s user namespace mapping facility. I am doing this with a couple of Python projects, and I haven’t yet worked out all the kinks, but in principle it’s reasonably straightforward. I found the following articles helpful:

• Align user IDs inside and outside Docker with subuser mapping.
• Docker userns-remap and system users on Linux.

A few other remarks:

• If you mount the codebase to the container, then you do not need to COPY it also in the image. The mount supersedes the copy.
• What user does your base image node:latest set for you? Is your own Dockerfile’s command USER node necessary?

Yeah I tried that too, I still get permissions errors with this:

RUN mkdir -p /home/node/app
WORKDIR /home/node/app

You should not run node as root, bad things can happen (see the last issue with changing files permissions). I think you need to make sure that when the node user is created it has the right permissions over /home/node (eg. https://github.com/vvo/selenium-standalone/blob/master/Dockerfile#L29). Maybe the permissions are not well propagated to subsequent directories:

@ORESoftware do a docker exec ls -al /home/node/app and check who owns that?

Note this comment in the Best Practices documentation: # At the end, set the user to use when running this image. What I ended up doing is running the Dockefile as the root user, then copying everything I need, using the --chown node:node flag in the COPY command when needed, then changing the user to node before running the application.

FROM node:14.15.4-slim
WORKDIR /home/node
COPY --from=build --chown=node:node ./ /home/node
ENV NODE_ENV="production"
ENV PORT="8080"
EXPOSE 8080
USER node
CMD ["node", "app.js"]

I was able to solve this with a newer docker backend component called buildkit. Buildkit mode is enabled by default for Docker Desktop users, and can be enabled manually by setting an environment variable when building the image:

DOCKER_BUILDKIT=1 docker build ...

Buildkit creates directories a little differently. Say we have a dockerfile that just prints out details of the WORKDIR:

FROM node:18-alpine
USER node
WORKDIR /app
CMD stat /app

Without buildkit, the WORKDIR is owned by root:

$ docker build --quiet . -t demo
sha256:28817c441bf181fa589ed827acc08bed54605977f26c46b4923e69da2261d21d
$ docker run --rm demo
  File: /app
  Size: 4096      	Blocks: 8          IO Block: 4096   directory
Device: 93h/147d	Inode: 22454774    Links: 2
Access: (0755/drwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
...

With buildkit, the WORKDIR is owned by our USER:

$ DOCKER_BUILDKIT=1 docker build --quiet . -t demo
sha256:37ae7418d59cba2024bff10c798f6577b1de84ddd8a275d12b63cad19554d759
$ docker run --rm demo
  File: /app
  Size: 4096      	Blocks: 8          IO Block: 4096   directory
Device: 8dh/141d	Inode: 22558956    Links: 2
Access: (0755/drwxr-xr-x)  Uid: ( 1000/    node)   Gid: ( 1000/    node)
...

When the WORKDIR is owned by the USER, any further RUN commands that want to create files in the WORKDIR will have enough permissions.

hi guys,

sometimes this happens - when the container you are trying to use (FROM) - set up the user already and it is different from the root. In this case permission is denied

I added ‘user: node’ on my docker-compose.yml and it fixed the issue.

version: '3'
services:
  app-name:
    user: node

Guys, I’m absolultly shit at Docker, I don’t understand anything in this thread. Can someone please help me?

Here’s my Dockerfile:

FROM node:latest

WORKDIR /usr/src/app

COPY package.json ./
COPY yarn.lock ./

RUN yarn

COPY . .
COPY .env.production .env

RUN yarn build
RUN yarn db:pull

ENV NODE_ENV production

EXPOSE 3000
CMD [ "node", "dist/main" ]

USER node

I get this error:

yarn docker:run
yarn run v1.22.10
$ docker run -p 3000:3000 blog-api
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [NestFactory] Starting Nest application...
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] AppModule dependencies initialized +129ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] PassportModule dependencies initialized +1ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] ThrottlerModule dependencies initialized +1ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] JwtModule dependencies initialized +0ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] ConfigHostModule dependencies initialized +0ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] UsersModule dependencies initialized +1ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] ConfigModule dependencies initialized +2ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] AuthModule dependencies initialized +1ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] PostsModule dependencies initialized +0ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] CategoriesModule dependencies initialized +1ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] GraphQLSchemaBuilderModule dependencies initialized +0ms
[Nest] 1  - 11/08/2021, 6:12:26 PM     LOG [InstanceLoader] GraphQLModule dependencies initialized +1ms
node:internal/process/promises:246
          triggerUncaughtException(err, true /* fromPromise */);
          ^

[Error: EACCES: permission denied, open '/usr/src/app/schema.gql'] {
  errno: -13,
  code: 'EACCES',
  syscall: 'open',
  path: '/usr/src/app/schema.gql'
}

This worked for me. A combination of using the existing /home/node dir to host the app files and specifying the user and group for the COPY commands.

FROM node:12.10.0-slim

USER node
RUN mkdir -p /home/node/app
WORKDIR /home/node/app

COPY --chown=node:node package.json .
COPY --chown=node:node yarn.lock .

RUN yarn --pure-lockfile

COPY --chown=node:node . .

EXPOSE 4040

CMD [ "node", "index.js" ]

Years later, you are helping me when several guides from well-known tech companies have failed. Thanks!

I know WORKDIR permissions

@herbievine , I think your problem is that WORKDIR creates the working directory as root, but the process is running as user node when you run the CMD. (Pretty sure the default user for the image node – your base image – is user node.) This means that GraphQL (or anything else) can’t create files in the working directory, which is what appears to be problem here.

The likely fix is to explicitly create the WORKDIR directory and give it correct ownership and permissions before you select it as WORKDIR. You may need to do this as root:

USER root
# Do stuff ...
USER node

Don’t stay as user root for the rest of the image, it exposes a lot of security vulnerabilities and you DO NOT want that.

This dockerfile works fine with any image but the issue comes when you try to mount the volume <current_dir>:/home/node

FROM node:latest

ENV NODE_ENV="development"
ENV PORT="4000"

WORKDIR /home/node
COPY --chown=node:node ./node_project /home/node

RUN npm install
EXPOSE ${PORT}
USER node

ENTRYPOINT ["npm", "run", "dev"]

version: "3.1"

services:
  node:
    build:
      context: .
      dockerfile: node.dockerfile
    container_name: node_server
    ports:
      - "4000:4000"
    volumes:
      - ./node_project:/home/node   ----------> this creates the issue, remove this and everything works

How to fix this? How to mount current folder as volume inside docker container?

may anyone could use it, we solved Jenkins Docker scripted pipeline build with the following setup/commands/variables: docker.image('node:8').inside("-e npm_config_cache=$env.WORKSPACE/.npm") { sh "npm install && export BABEL_CACHE_PATH=$env.WORKSPACE/.babel.json && npm run build" }