title: Permission denied inside Docker container on shared directory
body: <p>I'm new to Docker so I might not have some of the terminology correct. Inside the container I'm getting a permission denied error on a directory shared with the host. They appear to have matching uid:gid and the permissions host side are 777. The container is not for running in the background.</p>
  <p>I'm using the container to run a big series of untrusted programs one at a time each needing the same initial conditions. So I don't think it's feasible to copy stuff into the docker image at build time. I felt the optimal thing to do is copy the programs one at a time to a temp directory on the host and then share that directory with the fresh container for each run. I also need to collect the output from the container-run programs and keep them on the host so I can see how each program's output differs from the others.</p>
  <p>I have looked at the following questions/answers:</p>
  <ul>
  <li><a href="https://stackoverflow.com/questions/22049212/docker-copying-files-from-docker-container-to-host">Docker: Copying files from Docker container to host</a></li>
  <li><a href="https://stackoverflow.com/questions/48957195/how-to-fix-docker-got-permission-denied-issue">How to fix docker: Got permission denied issue</a> - successfully used to make docker run as someone other than root</li>
  <li><a href="https://stackoverflow.com/questions/49955097/how-do-i-add-a-user-when-im-using-alpine-as-a-base-image">How do I add a user when I'm using Alpine as a base image?</a> and <a href="https://wiki.alpinelinux.org/wiki/Setting_up_a_new_user" rel="nofollow noreferrer">Setting up a new user</a> - used to create the user and group</li>
  </ul>
  <p>I am:</p>
  <ul>
  <li>running docker as an ordinary user uid 1000, gid 1000, also belonging to the group <code>docker</code></li>
  <li>setting permissions on the shared directory host side to be 777 with uid:gid as <code>1000:1000</code> which is the same as the user</li>
  <li>setting the uid and gid inside the container to match uid and gid from the host</li>
  <li>using the Dockerfile to create a uid and gid each of <code>1000</code></li>
  </ul>
  <p>I read <a href="https://www.digitalocean.com/community/tutorials/how-to-share-data-between-the-docker-container-and-the-host" rel="nofollow noreferrer">here</a> that <code>If the first argument begins with a / or ~/, you’re creating a bindmount. Remove that, and you’re naming the volume.</code> So I tried both. The bindmount version seems to have the correct uid:gid but is permission denied, the volume version comes out as <code>root:root</code>.</p>
  <p>As a newbie it's hard to know what information to share so here's everything I think might be useful:</p>
  <h3>Docker command attempt 1</h3>
  <pre><code>[osboxes@osboxes tmp]$ pwd
  /var/tmp
  osboxes@osboxes tmp]$ whoami
  osboxes
  [osboxes@osboxes tmp]$ grep osboxes /etc/passwd
  osboxes:x:1000:1000:osboxes.org:/home/osboxes:/bin/bash
  [osboxes@osboxes tmp]$ groups
  osboxes wheel vboxsf docker
  [osboxes@osboxes tmp]$ grep osboxes /etc/group
  wheel:x:10:osboxes
  osboxes:x:1000:osboxes
  vboxsf:x:981:osboxes
  docker:x:1001:osboxes
  
  [osboxes@osboxes tmp]$ ls -al
  total 2
  drwxrwxrwt. 11 root    root    4096 Dec 31 12:13 .
  drwxr-xr-x. 21 root    root    4096 Jul  5 05:00 ..
  drwxr-xr-x.  2 abrt    abrt       6 Jul  5 05:00 abrt
  drwxrwxrwx.  2 osboxes osboxes    6 Dec 31 12:13 host
  </code></pre>
  <p>continues...</p>
  <pre><code>[osboxes@osboxes tmp]$ docker run --rm -v /var/tmp/host:/var/tmp/container:rw \
  --user appuser:appgroup --workdir /var/tmp/container \
  -it alpine_bash_jdk11 /bin/bash
  bash-5.0$ pwd
  /var/tmp/container
  bash-5.0$ ls -al
  ls: can't open '.': Permission denied
  total 0
  bash-5.0$ ls -al ..
  total 0
  drwxrwxrwt    1 root     root            23 Dec 31 12:51 .
  drwxr-xr-x    1 root     root            17 Dec 16 10:31 ..
  drwxrwxrwx    2 appuser  appgroup         6 Dec 31 12:13 container
  bash-5.0$ whoami
  appuser
  bash-5.0$ groups
  appgroup
  bash-5.0$ grep appuser /etc/passwd
  appuser:x:1000:1000:Linux User,,,:/home/appuser:/sbin/nologin
  bash-5.0$ grep appuser /etc/group
  appgroup:x:1000:appuser
  </code></pre>
  <h3>Docker command attempt 2</h3>
  <pre><code>everything as before except
  for removing the qualified path to the host's
  /var/tmp/host directory
  
  docker run --rm -v host:/var/tmp/container:rw \
  --user appuser:appgroup --workdir /var/tmp/container \
  -it alpine_bash_jdk11 /bin/bash
  
  bash-5.0$ pwd
  /var/tmp/container
  bash-5.0$ ls -al
  total 0
  drwxr-xr-x    2 root     root             6 Dec 31 12:13 .
  drwxrwxrwt    1 root     root            23 Dec 31 13:03 ..
  bash-5.0$ ls -al ..
  total 0
  drwxrwxrwt    1 root     root            23 Dec 31 13:03 .
  drwxr-xr-x    1 root     root            17 Dec 16 10:31 ..
  drwxr-xr-x    2 root     root             6 Dec 31 12:13 container
  bash-5.0$ whoami
  appuser
  bash-5.0$ groups
  appgroup
  bash-5.0$ echo hello from contanier &gt; container.msg.txt
  bash: container.msg.txt: Permission denied
  </code></pre>
  <h3>Docker build command</h3>
  <pre><code>as user osboxes
  docker build -t alpine_bash_jdk11 .
  </code></pre>
  <h3>Dockerfile</h3>
  <pre><code>FROM alpine:latest
  RUN apk --no-cache update
  RUN apk add --no-cache bash
  RUN apk --no-cache add openjdk11 --repository=http://dl-cdn.alpinelinux.org/alpine/edge/community
  
  ENV JAVA_HOME=&quot;/usr/lib/jvm/default-jvm&quot;
  ENV PATH=$PATH:${JAVA_HOME}/bin
  
  RUN addgroup -g 1000 -S appgroup &amp;&amp; adduser -S appuser -G appgroup -u 1000
  USER appuser
  </code></pre>
  <p><strong>I haven't used docker compose because I'm still getting my head round basic docker.</strong></p>
  <h3>Virtual Machine which is the Docker Host</h3>
  <pre><code>CentOS 7.2003 from osboxes.org, organization's decision, not mine
  Linux osboxes 3.10.0-1160.11.1.el7.x86_64 #1 SMP Fri Dec 18 16:34:56 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
  I did a yum update, then yum installed all the stuff needed to install VirtualBox guest additions which is working ok
  Docker version 1.13.1, build 0be3e21/1.13.1
  </code></pre>
  <h3>Physical Host</h3>
  <pre><code>Windows 10 64-bit
  VirtualBox 6.1.4r136177
  both these are the organization's decisions
  </code></pre>