Docker-nginx: Permissions issue (using compose)

[sudoforge]

A simple compose configuration leaves my static files owned by the UID of my host user, and inaccessible to the nginx process.

nginx:
    image: nginx:stable-alpine
    volumes:
        - ./app:/usr/share/nginx/html
    ports:
        - '80:80'
        - '443:443'

The directory inside the container is, in this case, owned by 1000, which is the user's ID from my host machine. ./app/ simply contains a single index.html file.

I don't see any options in the documentation that cover permissions. Is there an environment variable I can submit to the container during build to change the UID of the www-data user?

[maxtuzz]

I've been having the same issue.

Getting permission denied when trying to access resources mounted as a volume with docker-compose.

I don't seem to have the same problem with just docker run - it looks like a docker-compose issue. Maybe we will be more successfull over at the compose repo.

I actually found a solution though, but it's not ideal. After the container is running you can change the volume permissions to the nginx user inside the container:

$ docker exec -ti {container_id} chown -R nginx /usr/share/nginx/html

On the host this will look like this for me in terms of ownership:

mtuz243@Max-WorkPC ~/D/d/s/swagger-ui> ll
total 44K
-rw-r--r--  1 systemd-timesync mtuz243 3.5K Aug  2 15:50 404.html
-rw-r--r--  1 systemd-timesync mtuz243   18 Aug  2 15:50 CNAME
drwx------  2 systemd-timesync mtuz243 4.0K Aug  2 15:50 config/
drwx------  2 systemd-timesync mtuz243 4.0K Aug  2 15:50 dist/
drwx------  2 systemd-timesync mtuz243 4.0K Aug  2 15:50 images/
-rw-r--r--  1 systemd-timesync mtuz243  653 Aug  2 15:50 index.html
drwx------ 11 systemd-timesync mtuz243 4.0K Aug  2 15:50 scripts/
drwx------  2 systemd-timesync mtuz243 4.0K Aug  2 15:50 spec-files/
drwx------  3 systemd-timesync mtuz243 4.0K Aug  2 15:50 styles/
drwx------  3 systemd-timesync mtuz243 4.0K Aug  2 15:50 templates/
drwx------  5 systemd-timesync mtuz243 4.0K Aug  2 15:50 views/

The good thing is that you only need to do this once and not every time you start up your comtainer with compose.

I tried adding it as an embedded command in my docker-compose.yml under nginx but it makes nginx crash :sweat_smile:.

I guess a more permanent solution would be to add a start script for Nginx container to change all permissions for folders and files to root with correct permissions. e.g.

chown -R root: /use/share/nginx/html
find /usr/share/nginx/html -type d | xargs chmod +xr
find /usr/share/nginx/html -type f | xargs chmod +r

But I'm just spitballing here.

Max

[frjaraur]

Hi, I think you are having issues with container's userids and your hosts's userids. You can create a specific user in your image with a specific userid to avoid mixing of container usernames vs host usernames. This way you could manage users and permissions on container runtime better.

Javier R.

[maxtuzz]

Yes. Which is why my ownership changes to systemd-timesync as it has the same userid as the nginx user in the container.

[frjaraur]

Dockerfile should create user/group nginx with a fixed high userid/groupid.

[maxtuzz]

I'm using stock image. Unfortunately, this is actually quite a common issue. Getting Jenkins up and running on the same docker host today used a UID of 1000 - which turned out to be some random SysAdmin.

When you're operating within a large enterprise it's quite common for these UID's to already be allocated to a user, even if they are quite high.

[frjaraur]

When you're operating within a large enterprise it's quite common for these UID's to already be allocated to a user, even if they are quite high.

That's true but there are so many userids for a docker engine host?? ;)

[maxtuzz]

Heh. Point taken. Trying to see what I can do about that with my limited control over the situation. The OS level puppet conf is handled by a different team so may have to go have a chat :)

Cheers

[sudoforge]

Whoops - forgot about this.

My particular issue was that SELinux was preventing the volume from being shared. This is fixed by using one of either the :z or :Z labels. Read more about volume labels here.

I'm closing this.

[kuncevic]

Running on my vps on ubuntu having same issue using https://github.com/DanWahlin/Angular-Docker-Microservices/blob/master/.docker/nginx.conf , however when running on my windows dev pc - all good
Tried $ docker exec -ti {container_id} chown -R nginx /usr/share/nginx/html saying chown: unknown user nginx
Any thoughts?

[nauticalcoder]

My particular issue was that SELinux was preventing the volume from being shared. This is fixed by using one of either the :z or :Z labels. Read more about volume labels here.

This isn't an option when using compose to create the volume.