Docker运行Vue应用遇vue-cli-service权限拒绝问题求助

成功构建Vue应用Docker镜像，但启动容器时出现内部权限拒绝错误，无法执行vue-cli-service命令。

我的Dockerfile #

FROM node:latest AS build

RUN mkdir /app
WORKDIR /app

COPY ["package.json", "package-lock.json*", "npm-shrinkwrap.json*", "./"]
RUN npm install

COPY . .

USER node

EXPOSE 8686

CMD ["npm", "run", "serve"]

运行命令及错误 #

执行启动命令：

sudo docker run -p 8888:8686 my-vue-app

得到错误：

[sudo] password for user: 

> educodingspace@0.1.0 serve
> vue-cli-service serve --port 8686

sh: 1: vue-cli-service: Permission denied

Docker构建信息 #

构建命令：

sudo docker build -t my-vue-app .

构建输出：

[+] Building 34.1s (11/11) FINISHED                                                                                                         
 => [internal] load build definition from Dockerfile                                                                                  0.0s
 => => transferring dockerfile: 410B                                                                                                  0.0s
 => [internal] load metadata for docker.io/library/node:latest                                                                        2.5s
 => [internal] load .dockerignore                                                                                                     0.0s
 => => transferring context: 2B                                                                                                       0.0s
 => [1/6] FROM docker.io/library/node:latest@sha256:64c46a664eccedec63941dab4027c178a36debe08a232d4f9d7da5aca91cff3d                 13.6s
 => => resolve docker.io/library/node:latest@sha256:64c46a664eccedec63941dab4027c178a36debe08a232d4f9d7da5aca91cff3d                  0.0s
 => => sha256:64c46a664eccedec63941dab4027c178a36debe08a232d4f9d7da5aca91cff3d 1.21kB / 1.21kB                                        0.0s
 => => sha256:aa70582e85cf5d05c7505bed0cfbf6846e369253f88f8eeeb0f9f57d86a40274 2.00kB / 2.00kB                                        0.0s
 => => sha256:5199d6829c9501975002f30375c1b1ff47c5a71b8bfa07d9696c33fa6fb42c7b 7.41kB / 7.41kB                                        0.0s
 => => sha256:1468e7ff95fcb865fbc4dee7094f8b99c4dcddd6eb2180cf044c7396baf6fc2f 49.58MB / 49.58MB                                      1.4s
 => => sha256:2cf9c2b42f41b1845f3e4421b723d56146db82939dc884555e077768e18132f4 24.05MB / 24.05MB                                      1.3s
 => => sha256:c4c40c3e3cdf945721f480e1d939aac857876fdb5c33b8fbfcf655c63b0b9428 64.14MB / 64.14MB                                      2.3s
 => => extracting sha256:1468e7ff95fcb865fbc4dee7094f8b99c4dcddd6eb2180cf044c7396baf6fc2f                                             1.6s
 => => sha256:c05cc1123d7e335d59b0f465c23b7ad2ad27f4875b6c3eab41c65a9b50efa382 211.18MB / 211.18MB                                    5.6s
 => => sha256:04f2356c02d21ef160986f7994210be28dab889b9ba0724e126bd2ee4ed21cd6 3.37kB / 3.37kB                                        1.7s
 => => sha256:6ddb20e283af7117b546019c38904abe23562b4c509835e197e90ece86329c8f 52.03MB / 52.03MB                                      3.6s
 => => sha256:1e529f01353c8cc4b282dcf88ea4afda96f67b51b4d50e1d66334db747e4dacb 1.25MB / 1.25MB                                        2.6s
 => => sha256:76462c7b107c254da6e449995ef8040b3445701fc0cbad6d027bb2324b2898fc 451B / 451B                                            2.9s
 => => extracting sha256:2cf9c2b42f41b1845f3e4421b723d56146db82939dc884555e077768e18132f4                                             0.5s
 => => extracting sha256:c4c40c3e3cdf945721f480e1d939aac857876fdb5c33b8fbfcf655c63b0b9428                                             2.0s
 => => extracting sha256:c05cc1123d7e335d59b0f465c23b7ad2ad27f4875b6c3eab41c65a9b50efa382                                             5.6s
 => => extracting sha256:04f2356c02d21ef160986f7994210be28dab889b9ba0724e126bd2ee4ed21cd6                                             0.0s
 => => extracting sha256:6ddb20e283af7117b546019c38904abe23562b4c509835e197e90ece86329c8f                                             1.7s
 => => extracting sha256:1e529f01353c8cc4b282dcf88ea4afda96f67b51b4d50e1d66334db747e4dacb                                             0.0s
 => => extracting sha256:76462c7b107c254da6e449995ef8040b3445701fc0cbad6d027bb2324b2898fc                                             0.0s
 => [internal] load build context                                                                                                     2.2s                                                                                         2.1s
 => [2/6] RUN mkdir /app                                                                                                              1.7s
 => [3/6] WORKDIR /app                                                                                                                0.0s
 => [4/6] COPY [package.json, package-lock.json*, npm-shrinkwrap.json*, ./]                                                           0.3s
 => [5/6] RUN npm install                                                                                                             9.6s
 => [6/6] COPY . .                                                                                                                    3.7s
 => exporting to image                                                                                                                2.4s
 => => exporting layers                                                                                                               2.4s
 => => writing image sha256:330b1738c423c9e9d53c7465e4ad4b2c581f8682f32e29fd9ef7369745254d4d                                          0.0s
 => => naming to docker.io/library/my-vue-app:latest      

解决方案 #

原因分析 #

切换到node用户后，该用户没有vue-cli-service的执行权限——npm install以root用户执行，生成的node_modules目录及其中的二进制文件权限属于root，普通node用户无法执行。

修复方案 #

方案1：调整权限后切换用户（推荐）

在Dockerfile中，执行完npm install和COPY . .后，修改/app目录的权限为node用户所有，再切换用户：

FROM node:latest AS build

RUN mkdir /app
WORKDIR /app

COPY ["package.json", "package-lock.json*", "npm-shrinkwrap.json*", "./"]
RUN npm install

COPY . .

# 修改/app目录权限为node用户
RUN chown -R node:node /app

USER node

EXPOSE 8686

CMD ["npm", "run", "serve"]

方案2：使用root用户运行（仅开发环境测试用）

去掉USER node指令，直接用root用户运行容器：

FROM node:latest AS build

RUN mkdir /app
WORKDIR /app

COPY ["package.json", "package-lock.json*", "npm-shrinkwrap.json*", "./"]
RUN npm install

COPY . .

EXPOSE 8686

CMD ["npm", "run", "serve"]

方案3：全局安装vue-cli-service（可选）

如果项目依赖全局的vue-cli，可在npm install时加上全局安装，确保node用户能访问到：

FROM node:latest AS build

RUN mkdir /app
WORKDIR /app

COPY ["package.json", "package-lock.json*", "npm-shrinkwrap.json*", "./"]
RUN npm install && npm install -g @vue/cli-service

COPY . .

USER node

EXPOSE 8686

CMD ["npm", "run", "serve"]

验证方法 #

修改Dockerfile后，重新构建镜像并运行：

sudo docker build -t my-vue-app .
sudo docker run -p 8888:8686 my-vue-app

内容的提问来源于stack exchange，提问作者lcyll