非root用户执行npm install遇权限错误，Dockerfile排查与解决

问题 #

作为Docker新手，尝试以系统用户身份执行npm install时，每次都会出现权限错误，无法访问/app/package-lock.json。询问当前Dockerfile是否正确，以及如何解决该错误。

报错信息 #

38.52 npm ERR! code EACCES
38.52 npm ERR! syscall open
38.52 npm ERR! path /app/package-lock.json
38.52 npm ERR! errno -13
38.52 npm ERR! Error: EACCES: permission denied, open '/app/package-lock.json'
38.52 npm ERR!  [Error: EACCES: permission denied, open '/app/package-lock.json'] {
38.52 npm ERR!   errno: -13,
38.52 npm ERR!   code: 'EACCES',
38.52 npm ERR!   syscall: 'open',
38.52 npm ERR!   path: '/app/package-lock.json'
38.52 npm ERR! }
38.52 npm ERR! 
38.52 npm ERR! The operation was rejected by your operating system.
38.52 npm ERR! It is likely you do not have the permissions to access this file as the current user
38.52 npm ERR! 
38.52 npm ERR! If you believe this might be a permissions issue, please double-check the
38.52 npm ERR! permissions of the file and its containing directories, or try running
38.52 npm ERR! the command again as root/Administrator.
38.52 
38.52 npm ERR! A complete log of this run can be found in: /home/app/.npm/_logs/2024-04-05T19_43_08_160Z-debug-0.log
------
Dockerfile:8
--------------------
   6 |     COPY . .
   7 |     
   8 | >>> RUN npm install
   9 |     
  10 |     EXPOSE 3000
--------------------
ERROR: failed to solve: process "/bin/sh -c npm install" did not complete successfully: exit code: 243

原Dockerfile #

FROM node:20.12-alpine3.18

RUN addgroup app && adduser -S -G app app
USER app

WORKDIR /app

COPY . .

RUN npm install

EXPOSE 3000

问题分析 #

原Dockerfile存在权限逻辑问题：

• 切换到app用户后执行COPY . .，复制到/app的文件/目录所有权默认是root用户
• app用户对这些属于root的文件没有写入权限，而npm install需要生成或修改package-lock.json，因此触发权限错误

解决方案 #

推荐使用Docker官方支持的COPY --chown参数，在复制文件时直接指定所有权为app用户，这样后续npm install就能正常执行。

修正后的Dockerfile #

FROM node:20.12-alpine3.18

RUN addgroup app && adduser -S -G app app

WORKDIR /app
# 复制文件时指定所有者为app用户
COPY --chown=app:app . .

USER app

RUN npm install

EXPOSE 3000

另一种可选方案（先修改目录权限）：

FROM node:20.12-alpine3.18

RUN addgroup app && adduser -S -G app app

WORKDIR /app
# 修改/app目录所有权为app用户
RUN chown app:app /app

USER app

COPY . .

RUN npm install

EXPOSE 3000

注意 #

不建议使用npm install --unsafe-perm参数，该参数会提升npm执行权限，存在安全风险，不符合非root用户运行容器的安全原则。

内容的提问来源于stack exchange，提问作者Thurunu Mihiranga