Ubuntu下Docker Desktop构建Quarkus Native Image遇JVMCIError权限问题

问题场景 #

Ubuntu 23.10 + Docker Desktop 4.23.0环境下，Quarkus新手完成官方示例运行后，执行容器化Native Build命令时失败，报错为无权限写入/project/svm_err_b_20231118T013054.112_pid81.md文件，根源是java.nio.file.AccessDeniedException，触发jdk.vm.ci.common.JVMCIError。

执行的命令：

./mvnw install -Dnative -Dquarkus.native.container-build=true -Dquarkus.native.container-runtime=docker

完整错误日志 #

Build resources:
 - 5.80GB of memory (75.6% of 7.67GB system memory, determined at start)
 - 10 thread(s) (100.0% of 10 available processor(s), determined at start)
[2/8] Performing analysis...  [*****]                                                                   (17.5s @ 1.18GB)
   10,678 reachable types   (85.9% of   12,426 total)
   15,175 reachable fields  (56.7% of   26,771 total)
   53,763 reachable methods (55.8% of   96,362 total)
    3,437 types,   104 fields, and 3,151 methods registered for reflection
       61 types,    59 fields, and    55 methods registered for JNI access
        4 native libraries: dl, pthread, rt, z
[3/8] Building universe...                                                                               (3.0s @ 0.91GB)
[4/8] Parsing methods...      [**]                                                                       (2.1s @ 1.07GB)
[5/8] Inlining methods...     [***]                                                                      (1.4s @ 1.17GB)
[6/8] Compiling methods...    [****]                                                                    (14.1s @ 1.19GB)
[7/8] Layouting methods...    [**]                                                                       (2.7s @ 1.82GB)

[8/8] Creating image...       [**]                                                                       (0.0s @ 2.28GB)
Fatal error: jdk.vm.ci.common.JVMCIError: java.nio.file.AccessDeniedException: /project/svm_err_b_20231118T013054.112_pid81.md
    at jdk.internal.vm.ci/jdk.vm.ci.common.JVMCIError.shouldNotReachHere(JVMCIError.java:52)
    at org.graalvm.nativeimage.pointsto/com.oracle.graal.pointsto.reports.ReportUtils.reportImpl(ReportUtils.java:174)
    at org.graalvm.nativeimage.pointsto/com.oracle.graal.pointsto.reports.ReportUtils.report(ReportUtils.java:155)
    at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.ProgressReporter.printEpilog(ProgressReporter.java:652)
    at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.reportEpilog(NativeImageGeneratorRunner.java:604)
    at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.buildImage(NativeImageGeneratorRunner.java:596)
    at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.build(NativeImageGeneratorRunner.java:720)
    at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.start(NativeImageGeneratorRunner.java:142)
    at org.graalvm.nativeimage.builder/com.oracle.svm.hosted.NativeImageGeneratorRunner.main(NativeImageGeneratorRunner.java:97)
Caused by: java.nio.file.AccessDeniedException: /project/svm_err_b_20231118T013054.112_pid81.md
    at java.base/sun.nio.fs.UnixException.translateToIOException(UnixException.java:90)
    at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:106)
    at java.base/sun.nio.fs.UnixException.rethrowAsIOException(UnixException.java:111)
    at java.base/sun.nio.fs.UnixFileSystemProvider.newByteChannel(UnixFileSystemProvider.java:261)
    at java.base/java.nio.file.Files.newByteChannel(Files.java:379)
    at java.base/java.nio.file.Files.createFile(Files.java:657)
    at org.graalvm.nativeimage.pointsto/com.oracle.graal.pointsto.reports.ReportUtils.reportImpl(ReportUtils.java:164)
    ... 7 more

环境信息 #

$ uname -a 
Linux jm 6.5.0-10-generic #10-Ubuntu SMP PREEMPT_DYNAMIC Fri Oct 13 13:49:38 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

$ java -version
Java HotSpot(TM) 64-Bit Server VM Oracle GraalVM 21.0.1+12.1 (build 21.0.1+12-jvmci-23.1-b19, mixed mode, sharing)

$ mvnw --version
Apache Maven 3.9.5 (57804ffe001d7215b5e7bcb531cf83df38f93546)

解决方案 #

1. 匹配容器与主机用户权限 #

Docker Desktop在Ubuntu上的目录共享可能存在UID/GID不匹配问题，容器内用户无权限写入挂载目录。通过指定容器运行用户为当前主机用户ID解决：

./mvnw install -Dnative -Dquarkus.native.container-build=true -Dquarkus.native.container-runtime=docker -Dquarkus.native.container-build-args="--user $(id -u):$(id -g)"

2. 禁用错误报告生成 #

临时绕过问题，通过GraalVM参数禁止生成错误报告文件：

./mvnw install -Dnative -Dquarkus.native.container-build=true -Dquarkus.native.container-runtime=docker -Dquarkus.native.additional-build-args="--no-error-report"

3. 检查主机项目目录权限 #

确保主机上项目目录有足够读写权限，可执行：

chmod -R 755 /path/to/your/quarkus/project

同时确认Docker Desktop文件共享设置已正确包含该目录，必要时重新配置共享。

4. 切换容器运行时（可选） #

若Docker权限问题持续，尝试用Podman替代Docker：

./mvnw install -Dnative -Dquarkus.native.container-build=true -Dquarkus.native.container-runtime=podman

内容的提问来源于stack exchange，提问作者John Manko