Spring Boot Buildpacks构建失败：unlinkat /workspace/BOOT-INF权限拒绝

我有一个可正常运行的Spring Boot 3.3.3服务，尝试在Podman容器内通过以下命令以Native模式编译：

mvnw clean package -Pnative spring-boot:build-image -Ddocker.publishRegistry.username=%username% -Ddocker.publishRegistry.password=%password% -Ddocker.publishRegistry.url=https://workharbour

Buildpack已拉取且编译过程看似正常，但最终在清理阶段失败，报错权限拒绝：

[INFO]     [creator]        22.2s (9.3% of total time) in 1321 GCs | Peak RSS: 6.36GB | CPU load: 9.61
[INFO]     [creator]     --------------------------------------------------------------------------------
[INFO]     [creator]     Produced artifacts:
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/it.pes.blab.anagrafiche.AnagraficheApplication (executable)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libawt.so (jdk_library)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libawt_headless.so (jdk_library)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libawt_xawt.so (jdk_library)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libfontmanager.so (jdk_library)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libfreetype.so (jdk_library)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libjava.so (jdk_library_shim)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libjavajpeg.so (jdk_library)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/libjvm.so (jdk_library_shim)
[INFO]     [creator]      /layers/paketo-buildpacks_native-image/native-image/liblcms.so (jdk_library)
[INFO]     [creator]     ================================================================================
[INFO]     [creator]     Finished generating 'AnagraficheApplication' in 3m 57s.
[INFO]     [creator]       Removing bytecode
[INFO]     [creator]     unable to invoke layer creator
[INFO]     [creator]     unable to remove /workspace/BOOT-INF
[INFO]     [creator]     unlinkat /workspace/BOOT-INF: permission denied
[INFO]     [creator]     ERROR: failed to build: exit status 1
[INFO] ------------------------------------------------------------------------
[INFO] BUILD FAILURE
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  05:58 min

使用的是Java 21，Buildpack已正确识别（日志中显示$BP_JVM_VERSION 21）。镜像似乎已构建完成，但清理阶段失败，请问该如何更好地调试此错误？

1. 跳过清理阶段验证镜像可用性 #

先跳过Buildpack的清理步骤，确认Native镜像本身是否可用：

• 添加参数-Dspring-boot.build-image.clean-skip=true重新执行构建：

mvnw clean package -Pnative spring-boot:build-image -Ddocker.publishRegistry.username=%username% -Ddocker.publishRegistry.password=%password% -Ddocker.publishRegistry.url=https://workharbour -Dspring-boot.build-image.clean-skip=true

如果构建成功，运行镜像验证功能正常，说明问题仅出在清理环节的权限配置上。

2. 检查Podman挂载目录权限 #

报错核心是容器内无法删除/workspace/BOOT-INF，大概率是本地项目目录挂载到容器时权限不匹配：

• 查看本地项目目录及BOOT-INF的权限：

ls -ld /path/to/your/project
ls -l /path/to/your/project/BOOT-INF

• 调试阶段可临时指定容器以root用户运行（生产环境不推荐），添加参数调整运行用户：

mvnw clean package -Pnative spring-boot:build-image -Ddocker.publishRegistry.username=%username% -Ddocker.publishRegistry.password=%password% -Ddocker.publishRegistry.url=https://workharbour -Dspring-boot.build-image.env=USER_ID=0,GROUP_ID=0

3. 启用Buildpack详细日志 #

添加日志参数获取清理阶段的权限细节：

• 执行带verbose参数的构建命令：

mvnw clean package -Pnative spring-boot:build-image -Ddocker.publishRegistry.username=%username% -Ddocker.publishRegistry.password=%password% -Ddocker.publishRegistry.url=https://workharbour -Dspring-boot.build-image.verbose=true

日志会输出文件所有者、权限属性等关键信息，帮助定位权限冲突点。

4. 手动进入容器模拟清理操作 #

直接启动Buildpack的builder容器，挂载项目目录排查问题：

• 拉取对应builder镜像：

podman pull paketobuildpacks/builder-jammy-native-image:latest

• 启动交互式容器并挂载项目目录：

podman run -it --rm -v /path/to/your/project:/workspace paketobuildpacks/builder-jammy-native-image:latest /bin/bash

• 在容器内尝试删除/workspace/BOOT-INF，查看具体报错：

rm -rf /workspace/BOOT-INF

若删除失败，检查目录所有者和当前用户权限：

ls -ld /workspace/BOOT-INF
id

根据结果调整本地目录权限，或在容器内切换到对应用户执行操作。

5. 确认版本兼容性 #

检查Paketo Buildpack版本是否适配Spring Boot 3.3.3和Java 21，可在pom.xml中指定明确的Buildpack版本：

<build>
  <plugins>
    <plugin>
      <groupId>org.springframework.boot</groupId>
      <artifactId>spring-boot-maven-plugin</artifactId>
      <configuration>
        <image>
          <buildpacks>
            <buildpack>paketo-buildpacks/java-native-image:latest</buildpack>
          </buildpacks>
        </image>
      </configuration>
    </plugin>
  </plugins>
</build>

之后重新执行构建命令。

内容的提问来源于stack exchange，提问作者Shine