使用Docker部署Laravel项目时遭遇权限错误

问题现象 #

项目已通过docker-compose构建并运行，但网站抛出权限错误：

无法以追加模式打开流或文件 "/var/www/storage/logs/laravel.log"：无法打开流：权限拒绝 尝试记录时发生异常：无法以追加模式打开流或文件 "/var/www/storage/logs/laravel.log"

问题根源 #

本地项目目录挂载到容器后，storage和bootstrap/cache目录的权限与容器内运行PHP-FPM的www用户（UID:1000，GID:1000）不匹配，导致无法写入日志文件。

解决方案 #

方法一：快速调整本地目录权限 #

在本地项目根目录执行以下命令，同步目录权限与容器内用户一致：

sudo chown -R 1000:1000 storage bootstrap/cache
sudo chmod -R 775 storage bootstrap/cache

方法二：构建镜像时自动配置权限 #

修改Dockerfile，在COPY --chown=www:www . /var/www之后添加权限设置命令：

# 配置Laravel可写目录权限
RUN chmod -R 775 storage bootstrap/cache
RUN chown -R www:www storage bootstrap/cache

重新构建并启动容器：

docker-compose down
docker-compose build --no-cache
docker-compose up -d

方法三：优化挂载配置避免权限冲突 #

修改docker-compose.yml的app服务挂载规则，将storage和bootstrap/cache设为容器独立卷，让容器自行管理权限：

# app服务的volumes部分修改为：
volumes:
  - ./:/var/www
  - ./php/local.ini:/usr/local/etc/php/conf.d/local.ini
  - app-storage:/var/www/storage
  - app-bootstrap:/var/www/bootstrap/cache

# 全局volumes部分添加：
volumes:
  dbdata:
    driver: local
  app-storage:
  app-bootstrap:

原始配置文件 #

docker-compose.yml #

version: '3'
services:

  #PHP Service
  app:
    build:
      context: .
      dockerfile: Dockerfile
    image: digitalocean.com/php
    container_name: app
    restart: unless-stopped
    tty: true
    environment:
      SERVICE_NAME: app
      SERVICE_TAGS: dev
    working_dir: /var/www
    volumes:
      - ./:/var/www
      - ./php/local.ini:/usr/local/etc/php/conf.d/local.ini
    networks:
      - app-network

  #Nginx Service
  webserver:
    image: nginx:alpine
    container_name: webserver
    restart: unless-stopped
    tty: true
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./:/var/www
      - ./nginx/conf.d/:/etc/nginx/conf.d/
    networks:
      - app-network

  #MySQL Service
  db:
    image: mysql:5.7.22
    container_name: db
    restart: unless-stopped
    tty: true
    ports:
      - "3306:3306"
    environment:
      MYSQL_DATABASE: laravel
      MYSQL_ROOT_PASSWORD: password
      SERVICE_TAGS: dev
      SERVICE_NAME: mysql
    volumes:
      - dbdata:/var/lib/mysql/
      - ./mysql/my.cnf:/etc/mysql/my.cnf
    networks:
      - app-network

#Docker Networks
networks:
  app-network:
    driver: bridge
#Volumes
volumes:
  dbdata:
    driver: local

Dockerfile #

FROM php:8.1-fpm

# Copy composer.lock and composer.json
COPY composer.lock composer.json /var/www/

# Set working directory
WORKDIR /var/www

# Install dependencies
RUN apt-get update && apt-get install -y \
    build-essential \
    mysql-client \
    libpng-dev \
    libjpeg62-turbo-dev \
    libfreetype6-dev \
    locales \
    zip \
    jpegoptim optipng pngquant gifsicle \
    vim \
    unzip \
    git \
    nano \
    curl \
    libzip-dev

# Clear cache
RUN apt-get clean && rm -rf /var/lib/apt/lists/*

# Install extensions
RUN docker-php-ext-install pdo_mysql mbstring zip exif pcntl
RUN docker-php-ext-configure gd --with-freetype=/usr/include/ --with-jpeg=/usr/include/
RUN docker-php-ext-install gd

RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer

RUN groupadd -g 1000 www
RUN useradd -u 1000 -ms /bin/bash -g www www

COPY . /var/www/

COPY --chown=www:www . /var/www

USER www

EXPOSE 9000

CMD ["php-fpm"]

内容的提问来源于stack exchange，提问作者Kamal Ələsgərli