Docker Desktop权限排查：安装tzdata遇Permission Denied错误

问题概述 #

在Docker Desktop环境下构建基于Alpine的镜像时，执行apk add tzdata命令始终遭遇权限错误，无论是否使用代理都无法完成安装。

涉及Dockerfile #

FROM golang:1.18-alpine AS builder

WORKDIR /go/src/github.com/org/repo
COPY . .

RUN go mod init
RUN go build -o deploy/api-status

FROM alpine:latest
COPY --from=builder /go/src/github.com/org/repo/deploy/  ./deploy
RUN sed -ie "s/https/http/g" /etc/apk/repositories
RUN apk add tzdata

ENTRYPOINT ./deploy/api-status

报错信息 #

使用代理时的错误 #

#51 [api-status stage-1 5/5] RUN apk add tzdata
#51 0.671 fetch http://dl-cdn.alpinelinux.org/alpine/v3.20/main/x86_64/APKINDEX.tar.gz
#51 1.544 fetch http://dl-cdn.alpinelinux.org/alpine/v3.20/community/x86_64/APKINDEX.tar.gz
#51 3.828 (1/1) Installing tzdata (2024a-r1)
#51 4.120 ERROR: tzdata-2024a-r1: Permission denied
#51 4.126 1 error; 8 MiB in 14 packages

未使用代理时的错误 #

0.566 fetch http://dl-cdn.alpinelinux.org/alpine/v3.20/main/x86_64/APKINDEX.tar.gz
1.019 fetch http://dl-cdn.alpinelinux.org/alpine/v3.20/community/x86_64/APKINDEX.tar.gz
1.023 WARNING: updating and opening http://dl-cdn.alpinelinux.org/alpine/v3.20/main: Permission      denied
1.353 WARNING: updating and opening http://dl-cdn.alpinelinux.org/alpine/v3.20/community: Permission denied
1.353 ERROR: unable to select packages:
1.353   tzdata (no such package):
1.353     required by: world[tzdata]

解决方案及修改后的Dockerfile #

核心问题分析 #

1. 用户权限不足：虽然Alpine默认以root启动，但某些场景下可能被隐式切换到非root用户，导致无法修改系统文件或安装包。
2. 仓库配置文件权限异常：执行sed修改/etc/apk/repositories后，文件权限可能被改变，导致APK无法读取仓库索引。
3. 缓存损坏：旧的APK缓存可能引发权限校验失败或包索引异常。

修改后的Dockerfile #

FROM golang:1.18-alpine AS builder

WORKDIR /go/src/github.com/org/repo
COPY . .

RUN go mod init
RUN go build -o deploy/api-status

FROM alpine:latest
COPY --from=builder /go/src/github.com/org/repo/deploy/  ./deploy
# 明确以root用户执行后续系统操作
USER root
# 修改仓库地址后恢复默认权限
RUN sed -ie "s/https/http/g" /etc/apk/repositories && chmod 644 /etc/apk/repositories
# 清理缓存并更新索引，再安装tzdata
RUN apk cache clean && apk update && apk add tzdata

ENTRYPOINT ./deploy/api-status

关键修改说明 #

• USER root：强制切换回root用户，确保拥有操作系统文件和安装软件包的完整权限。
• chmod 644 /etc/apk/repositories：将仓库配置文件恢复为默认的可读权限，避免APK因无法读取仓库地址而报错。
• apk cache clean && apk update：清理旧缓存并重新拉取最新的仓库索引，解决缓存损坏导致的权限或包找不到问题。

内容的提问来源于stack exchange，提问作者Santrupta Sarangi