Docker中npm用户权限问题原因咨询

我正在学习Docker，此前编写的Dockerfile在构建阶段出现npm权限错误，现已解决，但想了解问题根源。以下是相关文件及错误日志，现解析问题原因：

出错的Dockerfile #

FROM node:16.20.0-alpine3.17
RUN addgroup app && adduser -S -G app app
USER app
WORKDIR /usr/app
COPY package*.json /usr/app
RUN npm install
COPY . .
ENV API_URL=http://api.myapp.com/
EXPOSE 3000
CMD npm run

构建阶段错误日志 #

#0 22.90 npm notice
#0 22.90 npm notice New major version of npm available! 8.19.4 -> 9.6.4
#0 22.90 npm notice Changelog: <https://github.com/npm/cli/releases/tag/v9.6.4>
#0 22.90 npm notice Run `npm install -g npm@9.6.4` to update!
#0 22.90 npm notice
#0 22.90 npm ERR! code EACCES
#0 22.90 npm ERR! syscall open
#0 22.90 npm ERR! path /usr/app/package-lock.json
#0 22.90 npm ERR! errno -13
#0 22.90 npm ERR! Error: EACCES: permission denied, open '/usr/app/package-lock.json'
#0 22.90 npm ERR!  [Error: EACCES: permission denied, open '/usr/app/package-lock.json'] {
#0 22.90 npm ERR!   errno: -13,
#0 22.90 npm ERR!   code: 'EACCES',
#0 22.90 npm ERR!   syscall: 'open',
#0 22.90 npm ERR!   path: '/usr/app/package-lock.json'
#0 22.90 npm ERR! }
#0 22.90 npm ERR!
#0 22.90 npm ERR! The operation was rejected by your operating system.
#0 22.90 npm ERR! It is likely you do not have the permissions to access this file as the current user
#0 22.90 npm ERR!
#0 22.90 npm ERR! If you believe this might be a permissions issue, please double-check the
#0 22.90 npm ERR! permissions of the file and its containing directories, or try running
#0 22.90 npm ERR! the command again as root/Administrator.
#0 22.90
#0 22.90 npm ERR! A complete log of this run can be found in:
#0 22.90 npm ERR!     /home/app/.npm/_logs/2023-04-07T10_17_38_968Z-debug-0.log
------
Dockerfile:6
--------------------
   4 |     WORKDIR /usr/app
   5 |     COPY package*.json /usr/app
   6 | >>> RUN npm install
   7 |     COPY . .
   8 |     ENV API_URL=http://api.myapp.com/
--------------------
ERROR: failed to solve: process "/bin/sh -c npm install" did not complete successfully: exit code: 243

修复后的Dockerfile #

FROM node:14.16.0-alpine3.13
RUN addgroup app && adduser -S -G app app
USER app
WORKDIR /app
COPY package*.json .
RUN npm install
COPY . .
ENV API_URL=http://api.myapp.com/
EXPOSE 3000
CMD ["npm", "start"]

错误根源分析 #

1. 工作目录权限不匹配 #

原Dockerfile选用/usr/app作为工作目录，该目录在官方node镜像中默认由root用户所有。切换到app非特权用户后，app仅拥有该目录的读取权限，无写入权限。执行npm install时，npm需要在当前目录生成package-lock.json并创建node_modules目录，因权限不足触发EACCES错误。

修复后的Dockerfile改用/app作为工作目录：以app用户执行WORKDIR /app时，Docker会自动创建该目录，且目录所有者为app用户，拥有完整读写权限，npm install可正常执行。

2. 其他次要问题 #

• 原Dockerfile中CMD npm run属于语法错误（缺少具体脚本名称），但这是运行时问题，与本次构建阶段的权限错误无关。
• COPY指令默认以root权限复制文件，即使已切换到app用户，复制到/usr/app的文件所有者仍为root，但本次错误核心是目录写入权限，而非文件本身权限。

内容的提问来源于stack exchange，提问作者Dr. Waka