Permission errors with non-root USER when running on Linux I have been getting some unexpected failures with the execution of my Docker images when running on my Ubuntu 16.04.3 LTS machine. I'm using Docker version 18.02.0-ce (edge), installed from apt. I've narrowed down the problem enough to demonstrate it with this Dockerfile:

FROM tomcat:8.5.24-jre8-alpine

RUN adduser -D test

RUN chown -R test "$CATALINA_HOME"

USER test

RUN ls "$CATALINA_HOME"/webapps


When I attempt to build this, here's the result:

$ docker build -t test test/
Sending build context to Docker daemon  163.4MB
Step 1/5 : FROM tomcat:8.5.24-jre8-alpine
 ---&gt; 134d23a9a14e
Step 2/5 : RUN adduser -D test
 ---&gt; Using cache
 ---&gt; a6f70ba83b8d
Step 3/5 : RUN chown -R test "$CATALINA_HOME"
 ---&gt; Using cache
 ---&gt; 8a0fae3db0a8
Step 4/5 : USER test
 ---&gt; Using cache
 ---&gt; 45fdf333232b
Step 5/5 : RUN ls "$CATALINA_HOME"/webapps
 ---&gt; Running in 48711dfb9569
ls: /usr/local/tomcat/webapps/ROOT: Permission denied
ls: /usr/local/tomcat/webapps/examples: Permission denied
ls: /usr/local/tomcat/webapps/docs: Permission denied
ls: /usr/local/tomcat/webapps/host-manager: Permission denied
ls: /usr/local/tomcat/webapps/manager: Permission denied
The command '/bin/sh -c ls "$CATALINA_HOME"/webapps' returned a non-zero code: 1


These "Permission denied" errors are very strange to me, since the chown command should have given ownership of the whole /usr/local/tomcat folder, including the subfolders.

I have tried this same scenario with many different versions of Docker on my Ubuntu host, all with the same result. However, when I tried building this image on my Mac OS machine, it worked fine.

One slight variation that I have found which works around the problem is to give the "test" user access to the "root" group, like so:

RUN adduser -D test -G root


With this simple change, the Dockerfile builds. So it seems obvious to me that somehow group membership permissions are involved, but I can't imagine why that would matter since the user is the owner. Also I can't imagine why building on Linux is different than building on Mac OS.


edit -
This seems to be the same issue described here: https://github.com/docker-library/tomcat/issues/35
As described in https://github.com/docker-library/tomcat/issues/35, this is related to the storage driver used (aufs).  Changing to use overlay2 solved the issue:

https://docs.docker.com/storage/storagedriver/overlayfs-driver/