执行docker compose up后Next.js访问package.json遇权限拒绝问题

执行docker compose up启动服务时出现以下错误：

frontend  | ready - started server on 0.0.0.0:3000, url: http://localhost:3000
frontend  | info  - Loaded env from /app/.env.local
frontend  | [Error: EACCES: permission denied, open '/app/.next/package.json'] {
frontend  |   errno: -13,
frontend  |   code: 'EACCES',
frontend  |   syscall: 'open',
frontend  |   path: '/app/.next/package.json'
frontend  | }
frontend exited with code 1

即使将文件设为777权限问题仍存在，已尝试修改文件/文件夹权限、重建容器、调整Dockerfile.dev中的USER和COPY配置，但未解决。相关配置文件如下：

Dockerfile.dev #

ARG BASE=node:16.17.1

# install deps
FROM ${BASE} AS project_name_frontend_dev

USER root
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm install

COPY --chown=node:node . .

EXPOSE 3000

# for dev purpose
CMD ["npm", "run", "dev"]

docker-compose.yml #

services:
  front:
    container_name: frontend
    build:
      context: .
      dockerfile: Dockerfile.prod
      args:
        ARG_NEXT_PUBLIC_FRONT_HOST: ${NEXT_PUBLIC_FRONT_HOST}
        ARG_NEXT_PUBLIC_API_HOST: ${NEXT_PUBLIC_API_HOST}
        ARG_NEXT_PUBLIC_FRONT_BASE: ${NEXT_PUBLIC_FRONT_BASE}
        ARG_NEXT_PUBLIC_API_BASE: ${NEXT_PUBLIC_API_BASE}
        ARG_NEXT_PUBLIC_MEDIA_PATH: ${NEXT_PUBLIC_MEDIA_PATH}
        ARG_NEXT_PUBLIC_IMAGES_DOMAIN: ${NEXT_PUBLIC_IMAGES_DOMAIN}
        ARG_NEXT_PUBLIC_GOOGLE_MAPS_KEY: ${NEXT_PUBLIC_GOOGLE_MAPS_KEY}
        ARG_NEXT_PUBLIC_GOOGLE_CLIENT_ID: ${NEXT_PUBLIC_GOOGLE_CLIENT_ID}
        ARG_NEXT_PUBLIC_FB_APP_ID: ${NEXT_PUBLIC_FB_APP_ID}
        ARG_NEXT_PUBLIC_CHAT_HOST: ${ARG_NEXT_PUBLIC_CHAT_HOST}
        ARG_NEXT_PUBLIC_CHAT_BASE: ${ARG_NEXT_PUBLIC_CHAT_BASE}

    networks:
      - project_net_name
    extra_hosts:
      - "api.project_name.local:ip-address"

networks:
  project_net_name:
    external: true

docker-compose.override.yml #

services:
  front:
    container_name: frontend
    build:
      context: .
      dockerfile: Dockerfile.dev
      target: project_name_frontend_dev
    networks:
      - project_net_name
    extra_hosts:
      - "api.project_name.local:ip-address"
    environment:
      NODE_TLS_REJECT_UNAUTHORIZED: 0
    volumes:
      - .:/app
      - /app/node_modules
      - /app/.next

1. 切换容器运行用户 #

问题核心是挂载目录权限与容器内用户不匹配。修改Dockerfile.dev，在启动命令前切换到node用户运行服务：

ARG BASE=node:16.17.1

# install deps
FROM ${BASE} AS project_name_frontend_dev

USER root
WORKDIR /app
COPY package.json package-lock.json ./
RUN npm install

COPY --chown=node:node . .

# 新增：切换到node用户
USER node

EXPOSE 3000

CMD ["npm", "run", "dev"]

2. 修复本地.next目录权限 #

在宿主机上修改.next目录权限，匹配容器内node用户的UID/GID（通常为1000）：

sudo chown -R 1000:1000 .next/

3. 调整卷挂载配置（可选） #

如果不想修改本地权限，可删除docker-compose.override.yml中/app/.next的匿名卷，让Next.js直接在本地挂载目录生成文件：

volumes:
  - .:/app
  - /app/node_modules
  # 移除这一行：- /app/.next

4. 彻底重建容器 #

修改配置后，执行以下命令清空旧容器和镜像，重新构建启动：

docker compose down -v
docker compose build --no-cache
docker compose up

内容的提问来源于stack exchange，提问作者Przemysław Ścigała