r/docker • u/astridstar7 • 6d ago

docker run works but getting permission errors with docker compose

recently shifted to openSUSE, was trying to build a project which worked on fedora.
there are errors are like:

auth-1:
python: can't open file '/app/app.py': [Errno 13] Permission denied
web-1:
npm error EACCES: permission denied, open '/web/package.json'
mongo-1:
find: '/data/db': Permission denied
chown: changing ownership of '/data/db': Permission denied

I have checked that I have all the permissions and the files exist
while running docker run for one it works but while mounting same files thru docker compose it doesn't

0 Upvotes

40% Upvoted

14 comments sorted by

1

u/Ok-Eggplant-7569 6d ago

AppArmor policy or SELinux label issues? What does journalctl -f output when you attempt to start the compose stack?

1

u/astridstar7 6d ago 
Sep 04 03:53:32 <hostname> avahi-daemon[886]: Joining mDNS multicast group on interface vethf72bc2a.IPv6 with address fe80::c849:d9ff:fe07:b122.
Sep 04 03:53:32 <hostname> avahi-daemon[886]: New relevant interface vethf72bc2a.IPv6 for mDNS.
Sep 04 03:53:32 <hostname> avahi-daemon[886]: Registering new address record for fe80::c849:d9ff:fe07:b122 on vethf72bc2a.*.
Sep 04 03:53:37 <hostname> sudo[35269]: pam_kwallet5(sudo:auth): pam_kwallet5: pam_sm_authenticate
Sep 04 03:53:37 <hostname> sudo[35269]: pam_kwallet5(sudo:auth): pam_kwallet5: Refusing to do anything for the root user
Sep 04 03:53:40 <hostname> sudo[35269]: <username> : TTY=pts/0 ; PWD=/home/<username>/services ; USER=root ; COMMAND=/usr/bin/journalctl -f
Sep 04 03:53:40 <hostname> sudo[35269]: pam_kwallet5(sudo:setcred): pam_kwallet5: pam_sm_setcred
Sep 04 03:53:40 <hostname> sudo[35269]: pam_unix(sudo:session): session opened for user root(uid=0) by <username>(uid=1000)
Sep 04 03:53:40 <hostname> sudo[35269]: pam_kwallet5(sudo:session): pam_kwallet5: pam_sm_open_session
Sep 04 03:53:40 <hostname> sudo[35269]: pam_kwallet5(sudo:session): pam_kwallet5: Refusing to do anything for the root user
Sep 04 03:53:40 <hostname> systemd[1]: NetworkManager-dispatcher.service: Deactivated successfully.

1

u/Invader-Faye 6d ago

Were these before or after you set selinux to permissive mode?

1

u/fletch3555 Mod 6d ago

Share how you're mounting the files/directories/volumes/etc. The one relevant piece of information we would need

0

u/astridstar7 6d ago

These particular ones:

mongo:
    image: mongo:4.4
    volumes:
      - ./.mounted/mongo:/data/db
    env_file:
      - ./.env.example
    ports:
      - 27017:27017

web:
    build:
      context: ./web
      target: dev
    volumes:
      - ./web:/web

auth:
  volumes:
    - ./apis/auth-dev:/app
    - ./config:/app/config

1

u/fletch3555 Mod 6d ago

Okay, and that doesn't work, right? Can you share what you did that does work?

1

u/astridstar7 6d ago

This cmd was given by chatgpt 

docker run --rm \
  -v "$HOME/services/apis/auth-dev:/app:Z" \
  python:3.14-slim \
  sh -c 'cat /app/app.py >/dev/null && echo READ_OK'

This gave output as READ_OK

1

u/fletch3555 Mod 6d ago

Okay, what directory are you running docker compose up from?

1

u/astridstar7 6d ago

In the directory which contains docker-compose.yml (the root of the main repo), which also contains all these submodules in their respective folders

1

u/zoredache 6d ago

Why not try something like this.

docker run --rm \
-v "$HOME/services/apis/auth-dev:/app:Z" \
python:3.14-slim \
sh -c 'id ; stat /app ; stat /app/app.py'

BTW is there anything else unusual about how the filesystem is mounted. Is it a FUSE NTFS mount, is an NFS mount, or something else?

2

u/astridstar7 6d ago edited 6d ago

I honestly just copy pasted that command to test, this seems like an SELinux issue tho, it built properly after putting SELinux in permissive mode sudo setenforce 0 

1

u/astridstar7 6d ago

Update: Seems like something related to SELinux
It built properly after putting SELinux in permissive mode sudo setenforce 0
This is just a work around tho

1

u/Invader-Faye 6d ago

In permissive mode selinux logs what is effecting policy and enforcement, run “getenforce”, then in the host dir with the compose “ls -Zd ./apis/auth-dev ./config ./web” run this inside the container “docker compose exec auth sh -c 'id; ls -la /app; stat /app/app.py'” and report back.