Docker容器退出错误码126：tsc-watch权限拒绝问题求解

问题详情 #

• 项目包含4个容器：backend、frontend、db、redis，backend容器自昨日起因错误码126停止运行
• 容器日志报错：

backend          | yarn run v1.22.15
backend          | $ tsc-watch --onSuccess "yarn start"
backend          | /bin/sh: 1: tsc-watch: Permission denied
backend          | error Command failed with exit code 126.

• 对应的backend Dockerfile内容：

# ================ #
#    Base Stage    #
# ================ #
FROM node:18-buster-slim as base

WORKDIR /opt/backend

RUN apt-get update && \
    apt-get upgrade -y --no-install-recommends && \
    apt-get install -y --no-install-recommends build-essential python3 libfontconfig1 dumb-init && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

ENV NODE_OPTIONS="--enable-source-maps"

ENTRYPOINT ["dumb-init", "--"]

# =================== #
#  Development Stage  #
# =================== #
FROM base as development

ENV NODE_ENV="development"

RUN chown -R node:node /opt/backend/

USER node

CMD [ "yarn", "run", "docker:watch"]

• 唯一变更：本地执行了apt-get upgrade，此前项目运行正常
• 更新信息：以root身份进入容器手动执行命令仍报相同错误；src/和dist/目录所属用户组为node:node，文件权限664，目录权限775

解决方案 #

• 检查tsc-watch可执行文件权限

  1. 进入容器：docker exec -it backend bash
  2. 定位tsc-watch路径：which tsc-watch
  3. 查看该文件权限：ls -l $(which tsc-watch)
  4. 若缺少执行权限，添加权限：chmod +x $(which tsc-watch)

• 重新安装项目依赖

  1. 进入容器后，删除旧依赖和锁文件：rm -rf node_modules package-lock.json yarn.lock
  2. 重新安装依赖：yarn install

• 重新构建backend镜像（清除缓存）
  执行命令：docker-compose build backend --no-cache，避免因本地apt升级导致的镜像缓存异常

• 检查全局依赖目录权限
  若tsc-watch是全局安装，查看yarn全局目录权限：ls -l /home/node/.yarn/bin，确保node用户对该目录及文件有执行权限，若不足可执行：chmod -R +x /home/node/.yarn/bin

• 调整Dockerfile权限配置（可选）
  在Dockerfile的development阶段，添加对全局依赖目录的权限设置，比如：

  FROM base as development
  
  ENV NODE_ENV="development"
  
  RUN chown -R node:node /opt/backend/ /home/node/.yarn/
  USER node
  
  CMD [ "yarn", "run", "docker:watch"]
  

内容的提问来源于stack exchange，提问作者Feralheart