Docker-stacks: Permission denied when mounting local folders

[elyase]

When trying to mount my local folder notebooks, I get permission errors:

This is what I am running:

docker run -p 8888:8888  -v notebooks:/home/jovyan/work jupyter/datascience-notebook

This is the host id:

$ id
uid=1000(ubuntu) gid=1000(ubuntu) groups=1000(ubuntu),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),102(netdev),999(docker)

When I run a terminal in the notebook I get:

jovyan@5a558ca44dc4:~/work$ id                                                                                                     
uid=1000(jovyan) gid=100(users) groups=100(users) 

and these are the notebook logs:

[I 21:42:26.224 NotebookApp] Writing notebook-signing key to /home/jovyan/.local/share/jupyter/notebook_secret
[W 21:42:26.243 NotebookApp] Permission denied: Untitled.ipynb
[W 21:42:26.244 NotebookApp] 403 POST /api/contents (5.147.248.22) 32.97ms referer=http://52.28.157.67:8888/tree

Any ideas what could be going wrong?

[jakirkham]

I believe -v likes absolute paths. Could try notebooks -> $(pwd)/notebooks?

[elyase]

That did it, thanks! Is this a record for fastest resolution?

[jakirkham]

Glad it works. Hmm...I forgot to start my stopwatch. ;)

[ederfmartins]

Same problem

This is what I am running:

docker run -p 8888:8888  -v /home/ederfm/work/cv_rec/experiments/notebooks:/home/jovyan/work jupyter/scipy-notebook

As a side note, this command works 1 months ago.

$docker version
Client:
 Version:      1.11.1
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   5604cbe
 Built:        Tue Apr 26 23:43:49 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.11.1
 API version:  1.23
 Go version:   go1.5.4
 Git commit:   5604cbe
 Built:        Tue Apr 26 23:43:49 2016
 OS/Arch:      linux/amd64

host id:

$ id
uid=1001(ederfm) gid=1001(ederfm) grupos=1001(ederfm),4(adm),21(fax),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),109(netdev),113(lpadmin),123(scanner),129(sambashare),999(docker)

inside container

id                                                                                                            
uid=1000(jovyan) gid=100(users) groups=100(users) 

notebook logs:

notebook_1    | [I 18:42:37.117 NotebookApp] Creating new notebook in 
notebook_1    | [W 18:42:37.156 NotebookApp] Permission denied: Untitled.ipynb
notebook_1    | [W 18:42:37.159 NotebookApp] 403 POST /api/contents (172.17.0.1) 42.37ms referer=http://localhost:8888/tree

[dyno]

docker-machine upgrade fixed the problem this time.

[edoardovivo]

I have the same problem. I haven't tried the docker-machine fix, but what if I don't want to use docker-machine?

[edoardovivo]

Update: The only way I can make it work is if I set the permission of the whole directory to 777 using

chmod 777 /home/edoardo/Notebooks

And then run the container

docker run -d -p 8888:8888  -v /home/edoardo//Notebooks:/home/jovyan/work jupyter/scipy-notebook

But that is really undesirable. Moreover, any jupyter notebook I write is owned by root whereas I want my notebooks to be owned by my user. Any idea on how to fix this?

I have tried the following

docker run -d -p 8888:8888  -e NB_UID=$(id -u) --user root -v /home/edoardo//Notebooks:/home/jovyan/work jupyter/scipy-notebook

As suggested by the documentation, but then I cannot open localhost:8888 (Access denied).

[parente]

What OS is your host machine running? What version of docker? If the host is in a VM, what hypervisor?

[edoardovivo]

I'm on Ubuntu 16.04

docker version returns

Client:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:        Thu Aug 18 05:33:38 2016
 OS/Arch:      linux/amd64

Server:
 Version:      1.12.1
 API version:  1.24
 Go version:   go1.6.3
 Git commit:   23cf638
 Built:        Thu Aug 18 05:33:38 2016
 OS/Arch:      linux/amd64

No VM involved. Thank you.

[parente]

With a somewhat similar setup here (diff: Ubuntu 14.04 in a VM, docker 1.12.0):

$ mkdir test
$ ls -l test*
drwxr xr-x  3 pparente pparente        4096 Aug 26 06:14 test
$ chgrp 100 test
$ chmod g+w test
$ ls -l test*
drwxrwxr-x  3 pparente users        4096 Aug 26 06:14 test
$ docker run -it --rm -p 8888:8888 -v /home/pparente/test:/home/jovyan/work jupyter/scipy-notebook

And it works:

Basically, I gave the group 100 write access to the host directory. Since the NB_USER is in gid=100 in the images, it now has write access. I could have alternatively given uid=1000 write access to the host directory instead of the group.

With respect to the problem you see switching the notebook user ID, I suspect the server was still starting up when you tried to access the port and get a denied message. When you switch away from the default user ID on start, the script in the container recursively changes ownership over all of the files in /opt/conda and some files in the home directory. That said, I do see our logic has regressed because after I waited for the chown to finish (~1 minute), I got an exception about one directory still having bad permissions. I'll open a separate bug for that.

[kish7]

I have the same issue in windows 10. The same message comes up when I try to create a new notebook.
Any idea what I should do to fix it ?
Thanks in advance .

[laliux]

Same problem in my VPS Linux VPS.

Fix:

sudo chown ubuntu ./notebooks

In my VPS the ubuntu user has the id 1000, same as user "jovyan" inside docker.

Bst

[tripl3a]

Hey guys,

I had the same issue and solved it like this:

1. Create the host directory to be mapped before running the container. (Otherwise the folder will be created automatically but with owner/group root and that will cause the "permission denied" issue as well.)
2. For docker run add the argument -e NB_UID=1000 - Specify the uid of the jovyan user. Useful to mount host volumes with specific file ownership. For this option to take effect, you must run the container with --user root. (The start-notebook.sh script will su jovyan after adjusting the user id.) (Source)

Bests, A³

[itaysk]

Same problem on Windows 10 - WSL Ubuntu:
I'm running:

docker run -it --rm -p 8888:8888 -v $(pwd)/work:/home/jovyan/work jupyter/pyspark-notebook

Here's the dir listing from working dir:

drwxrwxrwx 1 itaysk 512 May  3 19:46 work

in the container:

uid=1000(jovyan) gid=100(users) groups=100(users)

on host:

uid=1000(itaysk) gid=1000(itaysk) groups=1000(itaysk) ...

From my understanding the fact that it's the same uid (1000) should be enough right?

[jakirkham]

My guess is these are subsequent comments are different issues than what the OP raised. Could people please raise new issues for these? Thanks :)

[itaysk]

sure https://github.com/jupyter/docker-stacks/issues/862