217

I'm trying to mount a volume in docker-compose to apache image. The problem is, that apache in my docker is run under www-data:www-data but the mounted directory is created under root:root. How can I specify the user of the mounted directory?

I tried to run command setupApacheRights.sh. chown -R www-data:www-data /var/www but it says chown: changing ownership of '/var/www/somefile': Permission denied

services:
    httpd:
        image: apache-image
        ports:
            - "80:80"
        volumes:
            - "./:/var/www/app"
        links:
            - redis
        command: /setupApacheRights.sh

I would prefer to be able to specify the user under which it will be mounted. Is there a way?

2

7 Answers 7

113

To achieve the desired behavior without changing owner / permissions on the host system, do the following steps.

  1. get the ID of the desired user and or group you want the permissions to match with executing the id command on your host system - this will show you the uid and gid of your current user and as well all IDs from all groups the user is in.

     $ id
    
  2. add the definition to your docker-compose.yml

     user: "${UID}:${GID}"
    

    so your file could look like this

     php: # this is my service name
         user: "${UID}:${GID}" # we added this line to get a specific user / group id
         image: php:7.3-fpm-alpine # this is my image
     # and so on
    
  3. set the values in your .env file

     UID=1000
     GID=1001
    

3a. Alternatively you can extend your ~/.bashrc file with:

    export UID GID

to define it globally rather than defining it in a .env file for each project. If this does not work for you (like on my current distro, the GID is not set by this), use the following two lines:

    export UID=$(id -u)
    export GID=$(id -g)

Thanks @SteenSchütt for the easy solution for defining the UID / GID globally.

Now your user in the container has the id 1000 and the group is 1001 and you can set that differently for every environment.

Note: Please replace the IDs I used with the user / group IDs you found on your host system. Since I cannot know which IDs your system is using I gave some example group and user IDs.

If you don't use docker-compose or want to know more different approaches to achieve this have a read through my source of information: https://dev.to/acro5piano/specifying-user-and-group-in-docker-i2e

If the volume mount folder does not exist on your machine, docker will create it (with root user), so please ensure that it already exists and is owned by the userid / groupid you want to use.

I add an example for a dokuwiki container to explain it better:

version: '3.5'
services:
  dokuwiki:
    user: "${UID}" # set a specific user id so the container can write in the data dir
    image: bitnami/dokuwiki:latest
    ports:
      - '8080:8080'
    volumes:
      - '/home/manuel/docker/dokuwiki/data:/bitnami/dokuwiki/'
    restart: unless-stopped
    expose:
      - "8080"

The dokuwiki container will only be able to initialize correctly if it has write access to the host directory /home/manuel/docker/dokuwiki/data.

If on startup this directory does not exist, docker will create it for us but it will have root:root as user & group. --> Therefore, the container startup will fail.

If we create the folder before starting the container

mkdir -P /home/manuel/docker/dokuwiki/data

and then check with

ls -nla /home/manuel/docker/dokuwiki/data| grep ' \.$'

which uid and gid the folder has - and check that they match the ones we put in our .env file in step 3. above.

17
  • 4
    In my case, the container won't discover its name, as the www-data user has gid and uid of 33. this leads to other problems for me.
    – k0pernikus
    Commented Jul 21, 2020 at 9:16
  • 1
    Not working for me (version 3.7). I had to create a new group 1000 on my host machine and add my user to the group 1000.
    – bpile
    Commented Jan 3, 2021 at 11:11
  • 1
    I found it much simpler to just add export UID GID to my .bashrc rather than defining it in a .env file for each project. Commented Apr 25, 2022 at 9:22
  • 1
    @k0pernikus, there is libnss-unknown (Debian and Ubuntu have a package) that you can install in the container and then any user that isn't in the /etc/passwd inside the container will get a synthesized pwent with home set according to environment. That makes applications that use getpwent work in containers with arbitrary user ID.
    – Jan Hudec
    Commented Sep 8, 2022 at 6:52
  • 1
    To expand on my previous suggestion of exporting GID - some distros don't have that variable defined, but may have it under another name such as GROUP, in which case you can export UID GID="$GROUP" in your bashrc or equivalent :) Commented Nov 20, 2022 at 21:35
70

The bad news is there's no owner/group/permission settings for volume 😢. The good news is the following trick will let you bake it into your config, so it's fully automated 🎉.

In your Dockerfile, create an empty directory in the right location and with desired settings.

This way, the directory will already be present when docker-compose mounts to the location. When the server mounts during boot (based on docker-compose), the mounting action happily leaves those permissions alone.

Dockerfile:

# setup folder before switching to user
RUN mkdir /volume_data
RUN chown postgres:postgres /volume_data
VOLUME /volume_data
USER postgres

docker-compose.yml

volumes:
   - /home/me/postgres_data:/volume_data

source

12
  • 4
    Error: chown: /volume_data: No such file or directory.. This doesn't work for me. I think it's because the docker-file is declaring the volume before the chown. RE: stackoverflow.com/questions/26145351 Commented Oct 12, 2019 at 5:47
  • Very odd if the preceding mkdir ran without issue. I would try to add a short sleep command and a test command to verify the directory exists, but neither should be necessary here.
    – mahemoff
    Commented Oct 21, 2019 at 23:30
  • 70
    doesn't work, the uid/gid on the mountpoint get overridden by the host permissions Commented Feb 26, 2020 at 7:02
  • 1
    @RohanWarwar What do you mean by declaring the volume? It creates the volume_data folder, then sets permission on it.
    – mahemoff
    Commented Mar 15, 2020 at 7:29
  • 5
    Worked very well for me Commented Mar 14, 2021 at 13:58
41

First determine the uid of the www-data user:

$ docker exec DOCKER_CONTAINER_ID id
uid=100(www-data) gid=101(www-data) groups=101(www-data)

Then, on your docker host, change the owner of the mounted directory using the uid (100 in this example):

chown -R 100 ./

Dynamic Extension

If you are using docker-compose you may as well go for it like this:

$ docker-compose exec SERVICE_NAME id
uid=100(www-data) gid=101(www-data) groups=101(www-data)
$ chown -R 100 ./

You can put that in a one-liner:

$ chown -R $(docker-compose exec SERVICE_NAME id -u) ./

The -u flag will only print the uid to stdout.

Edit: fixed casing error of CLI flag. Thanks @jcalfee314!

9
  • 31
    Thank you for the answer. But that isn't very dynamic. I'd say that the main goal of setting this up should be something that doesn't need further customisations. However there isn't any other way to solve it or at least I wasn't able to find it. I'll try to build apache so it can run under root user, that might work too.
    – simPod
    Commented Nov 15, 2016 at 18:10
  • No, indeed, it is not dynamic (you did not ask for that). But with some hacking you could build some scripts which gets the required information (expect the DOCKER_IMAGE_ID) dynamically. The core problem is that the permissions are determined by the host OS and the effective user by the container itself.
    – Arne L.
    Commented Nov 16, 2016 at 10:07
  • @simPod Please review my answer. Furthermore, please adjust your question.
    – Arne L.
    Commented Feb 8, 2017 at 10:57
  • Awesome! fixed my problem, thanks a lot for this tip
    – flks
    Commented Mar 27, 2018 at 11:44
  • 8
    @ArneL. I was too harsh, but the problem is real. The idea behind a docker-compose file is multiple devs can get some code and "it just works" as long as docker is installed. The moment you use something host specific (host user ids in this case), that breaks down. The advice given might work on linux but the next guy on windows or mac may be out of luck. Bind mounts have their uses but for this specific problem I think people are going to struggle less with a standard docker volume.
    – MikeyT
    Commented Jul 11, 2020 at 5:23
14

Adding rw to the end of the volume mount worked for me:

services:
    httpd:
        image: apache-image
        ports:
            - "80:80"
        volumes:
            - "./:/var/www/app:rw"
        links:
            - redis
        command: /setupApacheRights.sh
6
  • Hi John, this didn't work in my env. Do you happen to have an example that includes both the Dockerfile and the complete docker-compose.yml file? Thank you!
    – Manfred
    Commented Oct 17, 2020 at 6:14
  • I think it was a very specific docker container actually - I was using a Docker4Drupal image so I don't have the Dockerfile - this is the change I made to the compose file.
    – John
    Commented Oct 21, 2020 at 10:56
  • 8
    Are you even running the service under a non-root user?
    – Jaykul
    Commented Mar 27, 2021 at 23:16
  • well thank you, my problem has been resolved by using this Commented Jul 5, 2021 at 4:12
  • Great answer. This solved all my issues. Commented Dec 2, 2021 at 7:45
7

Set user www-data for this compose service

    user: "www-data:www-data"

Example:

 wordpress:
    depends_on:
      - db
    image: wordpress:5.5.3-fpm-alpine
    user: "www-data:www-data"
    container_name: wordpress
    restart: unless-stopped
    env_file: 
      - .env
    volumes:
      - ./wordpress/wp-content:/var/www/html/wp-content
      - ./wordpress/wp-config-local.php:/var/www/html/wp-config.php
2
  • 1
    not worked for me, container keep restarting Commented Mar 11, 2023 at 5:48
  • @user2573099 if your container keeps restarting it probably arrives on some permission issue, which probably indicates some issues with your image
    – Jiří
    Commented Mar 11, 2023 at 20:22
1

If your volumes create ownership issue then you might need to find your volume mount path by

cmd: docker volume ls

After that identify your volume name then inspect your mount path

cmd: docker volume inspect <volume name>

check your mount point there and go on mount point on your docker host machine.

where check ownership of volume by

cmd: ls -l

if it's suggest root:root then change owneship here to your docker user.

cmd: chown docker_user_id:docker_group_id -R volume_path

Note: you can find your docker user id & user group id by entering into your docker bash & hit "id" cmd.

cmd: docker-compose run --rm <container_name> bash
cmd: id
output: uid=102(www-data) gid=102(www-data) groups=102(www-data)

Find similar thread here. https://www.hamaraweb.com/sms/407/docker-volume-ownership-issue-errno-13-permission-denied-bgb6ld/

1
  • 1
    This doesn't answer the question. You are explaining an alternative. Commented Mar 1, 2023 at 16:55
1

I know this wont solve this answer specifically, but if you are connecting to a network drive uid/gid to the options part of the connection like this:

volumes:
  downloadVol:
    driver_opts:
      type: cifs
      o: username=******,password=*****,uid=1000,gid=1000
      device: //your.ip.goes.here/downloads/

This is especially helpful when working with windows and docker.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.