Docker Compose启动容器时permission denied错误的排查与解决

错误信息 #

Error response from daemon: failed to create shim task: OCI runtime create failed: runc create failed: unable to start container process: exec: "./doc8": permission denied: unknown

相关配置文件 #

docker-compose.yml #

version: '3.7'
services:
  postgre-db:
    container_name: postgre-db
    image: postgres:12.2-alpine
    environment:
      POSTGRES_PASSWORD: postgres
      POSTGRES_USER: postgres
      POSTGRES_DB: postgres
    ports:
      - "5432:5432"
    volumes:
      - pgdata:/var/lib/postgresql/data
  doc8server:
    container_name: doc8server
    image: {IMAGE_NAME}
    env_file:
      - doc8.env
    build:
      context: .
      dockerfile: Dockerfile.doc8server.multistage
    ports:
      - "{PORT}:{PORT}"
    volumes:
      - doc8data:/opt/app/assets/pdfs
      - doc8data:/opt/app/assets/pdfs/originalFiles
    depends_on:
      - postgre-db
volumes:  
  pgdata: {}
  doc8data: {}

Dockerfile.doc8server.multistage #

FROM golang:latest as builder

LABEL maintainer="Doc8 <example@gmail.com>"

WORKDIR /app/invos_server_golang

COPY go.mod go.sum ./

RUN go mod download

COPY . .

WORKDIR /app/invos_server_golang

RUN CGO_ENABLED=0 GOOS=linux go build -a -installsuffix cgo -o doc8 .

FROM rastasheep/ubuntu-sshd:latest

WORKDIR /opt/app

COPY --from=builder /app/invos_server_golang/doc8 .
COPY --from=builder /app/invos_server_golang/doc8.env .

EXPOSE {PORT}

CMD ["./doc8"]

问题原因与解决方法 #

核心原因 #

构建生成的doc8二进制文件没有可执行权限，导致容器启动时无法执行该文件。

解决步骤 #

方法1：在COPY后添加权限赋予命令

修改Dockerfile的最终阶段，在复制完二进制文件后，添加chmod命令赋予可执行权限：

FROM rastasheep/ubuntu-sshd:latest

WORKDIR /opt/app

COPY --from=builder /app/invos_server_golang/doc8 .
COPY --from=builder /app/invos_server_golang/doc8.env .

# 添加这一行，赋予可执行权限
RUN chmod +x ./doc8

EXPOSE {PORT}

CMD ["./doc8"]

方法2：COPY时直接设置权限（推荐）

利用Docker的COPY命令参数，在复制文件时直接设置权限，减少额外的RUN命令：

FROM rastasheep/ubuntu-sshd:latest

WORKDIR /opt/app

# 使用--chmod参数设置可执行权限
COPY --from=builder --chmod=755 /app/invos_server_golang/doc8 .
COPY --from=builder /app/invos_server_golang/doc8.env .

EXPOSE {PORT}

CMD ["./doc8"]

额外排查点

如果上述方法无效，检查基础镜像rastasheep/ubuntu-sshd:latest的默认运行用户：

• 若镜像默认使用非root用户，可在CMD前添加USER root切换到root执行，或者确保该用户对./doc8有执行权限。

内容的提问来源于stack exchange，提问作者Dhananjay Gahiwade