Answers: <p>As described in <a href="https://github.com/docker-library/tomcat/issues/35" rel="nofollow noreferrer">https://github.com/docker-library/tomcat/issues/35</a>, this is related to the storage driver used (aufs).  Changing to use overlay2 solved the issue:</p>
  
  <p><a href="https://docs.docker.com/storage/storagedriver/overlayfs-driver/" rel="nofollow noreferrer">https://docs.docker.com/storage/storagedriver/overlayfs-driver/</a></p>
  
Answers: CC BY-SA 3.0
Answers: 2018-02-28T09:22:39.377Z
Answers: 2018-02-28T09:22:39.377Z
Answers: Jake Feasel
Body: <p>I have been getting some unexpected failures with the execution of my Docker images when running on my Ubuntu 16.04.3 LTS machine. I'm using Docker version 18.02.0-ce (edge), installed from apt. I've narrowed down the problem enough to demonstrate it with this Dockerfile:</p>
  
  <pre><code>FROM tomcat:8.5.24-jre8-alpine
  
  RUN adduser -D test
  
  RUN chown -R test "$CATALINA_HOME"
  
  USER test
  
  RUN ls "$CATALINA_HOME"/webapps
  </code></pre>
  
  <p>When I attempt to build this, here's the result:</p>
  
  <pre><code>$ docker build -t test test/
  Sending build context to Docker daemon  163.4MB
  Step 1/5 : FROM tomcat:8.5.24-jre8-alpine
   ---&gt; 134d23a9a14e
  Step 2/5 : RUN adduser -D test
   ---&gt; Using cache
   ---&gt; a6f70ba83b8d
  Step 3/5 : RUN chown -R test "$CATALINA_HOME"
   ---&gt; Using cache
   ---&gt; 8a0fae3db0a8
  Step 4/5 : USER test
   ---&gt; Using cache
   ---&gt; 45fdf333232b
  Step 5/5 : RUN ls "$CATALINA_HOME"/webapps
   ---&gt; Running in 48711dfb9569
  ls: /usr/local/tomcat/webapps/ROOT: Permission denied
  ls: /usr/local/tomcat/webapps/examples: Permission denied
  ls: /usr/local/tomcat/webapps/docs: Permission denied
  ls: /usr/local/tomcat/webapps/host-manager: Permission denied
  ls: /usr/local/tomcat/webapps/manager: Permission denied
  The command '/bin/sh -c ls "$CATALINA_HOME"/webapps' returned a non-zero code: 1
  </code></pre>
  
  <p>These "Permission denied" errors are very strange to me, since the <code>chown</code> command should have given ownership of the whole /usr/local/tomcat folder, including the subfolders.</p>
  
  <p>I have tried this same scenario with many different versions of Docker on my Ubuntu host, all with the same result. However, when I tried building this image on my Mac OS machine, it worked fine.</p>
  
  <p>One slight variation that I have found which works around the problem is to give the "test" user access to the "root" group, like so:</p>
  
  <pre><code>RUN adduser -D test -G root
  </code></pre>
  
  <p>With this simple change, the Dockerfile builds. So it seems obvious to me that somehow group membership permissions are involved, but I can't imagine why that would matter since the user is the owner. Also I can't imagine why building on Linux is different than building on Mac OS.</p>
  
  <ul>
  <li>edit -
  This seems to be the same issue described here: <a href="https://github.com/docker-library/tomcat/issues/35" rel="nofollow noreferrer">https://github.com/docker-library/tomcat/issues/35</a></li>
  </ul>
  
Comments: CC BY-SA 3.0
Comments: 2018-02-23T19:56:13.450Z
Comments: I just ran your Dockerfile exactly, and had no errors. `~/test $ docker build -t tomcat-test .` It successfully listed everything in the 'webapps' dir. Try deleting the pulled image for `tomcat:8.5.24-jre8-alpine` (or even all your images) and rebuilding.
Comments: BoomShadow
Comments: CC BY-SA 3.0
Comments: 2018-02-23T22:06:31.340Z
Comments: @BoomShadow I've cleared out everything, even so far as to use `docker system prune -a` to clear the local cache. Unfortunately, the problem somehow persists. I assume you built on Linux?
Comments: Jake Feasel
Comments: CC BY-SA 3.0
Comments: 2018-02-23T22:12:39.580Z
Comments: May worth doing a ls -al $CATALINA_HOME to see ownership and permissions on its content instead of listing webapps content... But that sounds strange indeed (maybe an apparmor/selinux Config somewhere)
Comments: Tensibai
Comments: CC BY-SA 3.0
Comments: 2018-02-23T22:44:03.200Z
Comments: Is selinux running? Does it work if disabled?
Comments: James Shewey
Comments: CC BY-SA 3.0
Comments: 2018-02-23T23:09:40.277Z
Comments: @JamesShewey there is no selinux on my system.
Comments: Jake Feasel
Comments: CC BY-SA 3.0
Comments: 2018-02-23T23:12:44.123Z
Comments: @Tensibai I have disabled apparmor, with no improvement.
Comments: Jake Feasel
Comments: CC BY-SA 3.0
Comments: 2018-02-24T21:17:09.453Z
Comments: @JakeFeasel yep. I ran mine on Linux. I also just tried on Mac. Both work without issues. My Linux is Ubuntu 16.04 running docker stable 17.12.0-ce. I also just ran a 3rd test by installing Docker Edge 18.02.0-ce and ran it again. I still have no errors. Something must be wrong with your Docker and you need to re-install Docker itself.
Comments: BoomShadow
Comments: CC BY-SA 3.0
Comments: 2018-02-27T14:01:33.410Z
Comments: See update: https://github.com/docker-library/tomcat/issues/35
Comments: Jake Feasel
Comments: CC BY-SA 3.0
Comments: 2018-02-27T19:36:25.613Z
Comments: I built a Dockerfile like yours and got no errors, `Docker version 17.12.0-ce, build c97c6d6` :(.
Comments: Vincenzo Pii
Comments: CC BY-SA 3.0
Comments: 2018-02-28T23:16:48.907Z
Comments: Vincenzo - what docker storage driver were you using?
Comments: Jake Feasel
Tags: <docker><linux><permissions><user-namespaces>
Title: Permission errors with non-root USER when running on Linux
UserDisplayName: Jake Feasel
ThreadText: # Permission errors with non-root USER when running on Linux
  
  (Asked by: username_0 on 2018-02-23)
  
  I have been getting some unexpected failures with the execution of my Docker images when running on my Ubuntu 16.04.3 LTS machine. I'm using Docker version 18.02.0-ce (edge), installed from apt. I've narrowed down the problem enough to demonstrate it with this Dockerfile:
  
  ```
  FROM tomcat:8.5.24-jre8-alpine
  
  RUN adduser -D test
  
  RUN chown -R test "$CATALINA_HOME"
  
  USER test
  
  RUN ls "$CATALINA_HOME"/webapps
  
  ```
  
  When I attempt to build this, here's the result:
  
  ```
  $ docker build -t test test/
  Sending build context to Docker daemon  163.4MB
  Step 1/5 : FROM tomcat:8.5.24-jre8-alpine
   ---> 134d23a9a14e
  Step 2/5 : RUN adduser -D test
   ---> Using cache
   ---> a6f70ba83b8d
  Step 3/5 : RUN chown -R test "$CATALINA_HOME"
   ---> Using cache
   ---> 8a0fae3db0a8
  Step 4/5 : USER test
   ---> Using cache
   ---> 45fdf333232b
  Step 5/5 : RUN ls "$CATALINA_HOME"/webapps
   ---> Running in 48711dfb9569
  ls: /usr/local/tomcat/webapps/ROOT: Permission denied
  ls: /usr/local/tomcat/webapps/examples: Permission denied
  ls: /usr/local/tomcat/webapps/docs: Permission denied
  ls: /usr/local/tomcat/webapps/host-manager: Permission denied
  ls: /usr/local/tomcat/webapps/manager: Permission denied
  The command '/bin/sh -c ls "$CATALINA_HOME"/webapps' returned a non-zero code: 1
  
  ```
  
  These "Permission denied" errors are very strange to me, since the `chown` command should have given ownership of the whole /usr/local/tomcat folder, including the subfolders.
  
  I have tried this same scenario with many different versions of Docker on my Ubuntu host, all with the same result. However, when I tried building this image on my Mac OS machine, it worked fine.
  
  One slight variation that I have found which works around the problem is to give the "test" user access to the "root" group, like so:
  
  ```
  RUN adduser -D test -G root
  
  ```
  
  With this simple change, the Dockerfile builds. So it seems obvious to me that somehow group membership permissions are involved, but I can't imagine why that would matter since the user is the owner. Also I can't imagine why building on Linux is different than building on Mac OS.
  
  * edit -
    This seems to be the same issue described here: <https://github.com/docker-library/tomcat/issues/35>
  
  **Tags:** docker, linux, permissions, user-namespaces
  
  > **Comments:**
  > **username_1**: I just ran your Dockerfile exactly, and had no errors. `~/test $ docker build -t tomcat-test .` It successfully listed everything in the 'webapps' dir. Try deleting the pulled image for `tomcat:8.5.24-jre8-alpine` (or even all your images) and rebuilding.  
  > **username_0**: @username_1 I've cleared out everything, even so far as to use `docker system prune -a` to clear the local cache. Unfortunately, the problem somehow persists. I assume you built on Linux?  
  > **username_2**: May worth doing a ls -al $CATALINA_HOME to see ownership and permissions on its content instead of listing webapps content... But that sounds strange indeed (maybe an apparmor/selinux Config somewhere)  
  > **username_3**: Is selinux running? Does it work if disabled?  
  > **username_0**: @username_3 there is no selinux on my system.  
  > **username_0**: @username_2 I have disabled apparmor, with no improvement.  
  > **username_1**: @username_0 yep. I ran mine on Linux. I also just tried on Mac. Both work without issues. My Linux is Ubuntu 16.04 running docker stable 17.12.0-ce. I also just ran a 3rd test by installing Docker Edge 18.02.0-ce and ran it again. I still have no errors. Something must be wrong with your Docker and you need to re-install Docker itself.  
  > **username_0**: See update: https://github.com/docker-library/tomcat/issues/35  
  > **username_4**: I built a Dockerfile like yours and got no errors, `Docker version 17.12.0-ce, build c97c6d6` :(.  
  > **username_0**: username_4 - what docker storage driver were you using?  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2018-02-28. Score: 2 | Accepted answer
  
  As described in <https://github.com/docker-library/tomcat/issues/35>, this is related to the storage driver used (aufs). Changing to use overlay2 solved the issue:
  
  <https://docs.docker.com/storage/storagedriver/overlayfs-driver/>
  
  
  ---
  
  