Atlassian Bamboo环境Docker中Sonar扫描创建目录失败求助

在Atlassian Bamboo环境中，尝试通过Docker容器运行Sonar扫描时遇到权限错误，执行命令：

docker run -v .:/opt/app sonar-scaner:1.1 sonar-scanner -X -Dsonar.projectKey=<MY_KEY> -Dsonar.sources=. -Dsonar.host.url=<URL> -Dsonar.login=<token>

报错信息：

Fail to create working dir: /opt/app/.scannerwork

需求是容器以bamboo用户而非root运行，因为root运行后，在Bamboo代理及本地WSL中清理.sonarscan文件夹会遇到权限问题（代理用户为bamboo）。当前使用的Dockerfile如下：

FROM alpine:3.21.3

# Args to download SSL cert to Sonar
ARG URL="company.local"

# Create bamboo user and group
RUN addgroup -S bamboo && adduser -S bamboo -G bamboo

# Set Sonar Scanner version
ENV SONAR_SCANNER_VERSION=5.0.1.3006
ENV SONAR_SCANNER_HOME=/opt/sonar-scanner/sonar-scanner-${SONAR_SCANNER_VERSION}-linux
ENV SONAR_USER_HOME=/opt/sonar-scanner/.sonar
ENV SONAR_SCANNER_OPTS="-Dsonar.working.directory=/opt/app/.scannerwork -server"

# Install mandatory dependencies
RUN apk add --no-cache curl zip unzip openjdk17-jre openssl ca-certificates

# Download sonar SSL certificate
RUN openssl s_client -showcerts -connect $URL:443 < /dev/null | openssl x509 > /usr/local/share/ca-certificates/sonar.crt

# Move Sonar Scanner installation outside /root to /opt (owned by bamboo)
RUN mkdir -p /opt/sonar-scanner \
    && curl --create-dirs -sSLo /tmp/sonar-scanner.zip https://binaries.sonarsource.com/Distribution/sonar-scanner-cli/sonar-scanner-cli-$SONAR_SCANNER_VERSION-linux.zip \
    && unzip -o /tmp/sonar-scanner.zip -d /opt/sonar-scanner/ \
    && rm /tmp/sonar-scanner.zip 

# Create necessary directories and set correct permissions
RUN mkdir -p /opt/app/.scannerwork \
    && chown -R bamboo:bamboo /opt/app /opt/sonar-scanner \
    && chmod -R 777 /opt/app/.scannerwork

# Disable the use of the embedded JRE
RUN sed -i 's/use_embedded_jre=true/use_embedded_jre=false/g' ${SONAR_SCANNER_HOME}/bin/sonar-scanner

# Add certificate to Java keytool
RUN update-ca-certificates
RUN keytool -import -trustcacerts -alias CA_till_2028 -file /usr/local/share/ca-certificates/sonar.crt -keystore /usr/lib/jvm/java-17-openjdk/lib/security/cacerts -storepass changeit -noprompt

# Set environment variables
ENV PATH="${SONAR_SCANNER_HOME}/bin:${PATH}"

# Create necessary directories and set correct permissions before switching user
RUN mkdir -p /opt/app/.scannerwork \
    && chown -R bamboo:bamboo /opt/app /opt/sonar-scanner \
    && chmod -R 777 /opt/app/.scannerwork

# Switch to bamboo user
USER bamboo

# Set working directory to /opt/app
WORKDIR /opt/app

1. 挂载目录权限不匹配：使用-v .:/opt/app挂载主机目录到容器时，容器内/opt/app目录的权限继承自主机当前目录。若主机Bamboo代理的bamboo用户UID/GID与容器内创建的bamboo用户不一致，容器内的bamboo用户将无权限在该目录下创建.scannerwork文件夹。
2. 提前创建的目录被挂载覆盖：Dockerfile中提前创建的/opt/app/.scannerwork目录，在挂载主机目录后会被覆盖，之前设置的权限完全失效。

1. 统一容器与主机的bamboo用户UID/GID #

在Dockerfile中创建bamboo用户时，指定与主机Bamboo代理相同的UID和GID：

# 替换原创建用户的命令，根据主机实际UID/GID修改参数
ARG BAMBOO_UID=1000
ARG BAMBOO_GID=1000
RUN addgroup -g $BAMBOO_GID -S bamboo && adduser -u $BAMBOO_UID -S bamboo -G bamboo

构建镜像时传入主机的UID/GID：

docker build --build-arg BAMBOO_UID=$(id -u bamboo) --build-arg BAMBOO_GID=$(id -g bamboo) -t sonar-scaner:1.1 .

2. 调整Dockerfile，移除挂载目录的提前创建步骤 #

删除Dockerfile中两次创建/opt/app/.scannerwork的命令，保留Sonar Scanner安装目录的权限设置：

# 在下载解压Sonar Scanner后添加：
RUN chown -R bamboo:bamboo /opt/sonar-scanner

3. 调整Sonar工作目录到非挂载目录（可选） #

若不想处理挂载目录权限，可将Sonar工作目录设置到容器内独立目录：
修改Dockerfile中的环境变量：

ENV SONAR_SCANNER_OPTS="-Dsonar.working.directory=/opt/sonar-scanner/.scannerwork -server"

同时创建该目录并设置权限：

RUN mkdir -p /opt/sonar-scanner/.scannerwork && chown -R bamboo:bamboo /opt/sonar-scanner/.scannerwork

4. 启动容器时临时调整权限（应急方案） #

若无法重新构建镜像，可先以root身份调整挂载目录权限，再切换到bamboo用户执行扫描：

docker run -v .:/opt/app sonar-scaner:1.1 sh -c "chown -R bamboo:bamboo /opt/app && su bamboo -c 'sonar-scanner -X -Dsonar.projectKey=<MY_KEY> -Dsonar.sources=. -Dsonar.host.url=<URL> -Dsonar.login=<token>'"

内容的提问来源于stack exchange，提问作者molek06