VS Code Dev Containers工作目录所有权频繁切换为root的问题

我正在使用VS Code的Dev Containers功能，但尽管已在镜像中设置了权限，工作目录内的文件所有权仍不断切换为root，导致我编辑文件时频繁出现“permission denied”错误。以下是我使用的Dockerfile和devcontainer.json文件：

Dockerfile内容 #

FROM rocker/r-ver:4.2.1

ARG USERNAME=user
ARG USER_UID=1000
ARG USER_GID=$USER_UID

# 创建非root用户
RUN groupadd --gid $USER_GID $USERNAME \
    && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME --shell /bin/bash \
    # 可选：添加sudo支持
    && apt-get update \
    && apt-get install -y sudo \
    && echo $USERNAME ALL=(root) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME \
    && chmod 0440 /etc/sudoers.d/$USERNAME

ENV PATH "${PATH}:/home/user/.local/bin"
RUN echo "export PATH=${PATH}" >> /home/user/.bashrc

RUN mkdir -p /home/user/workspace && \
    chown $USERNAME:$USER_UID /home/user/workspace
WORKDIR /home/user/workspace

USER $USERNAME

devcontainer.json内容 #

{
    "name":"R Development Environment",
    "build": {
        "dockerfile":"Dockerfile-r",
        "context":"..",
        "args": {"R_VERSION":"4.1.2"}
    },

    "settings": {
        "r.rterm.linux": "/usr/local/bin/radian",
        "r.bracketedPaste": true,
        "r.plot.useHttpgd": true,
        "[r]": {
            "editor.wordSeparators": "`~!@#%$^&*()-=+[{]}\\|;:'\",<>/?"
        }
    },
    "workspaceFolder":"/home/user/workspace",
    "workspaceMount": "source=${localWorkspaceFolder},target=/home/user/workspace,type=bind,consistency=cached",

    "extensions": [
        "REditorSupport.r",
        "rdebugger.r-debugger"
    ],
    "remoteUser": "user"
}

解决方案 #

1. 对齐本地与容器用户的UID/GID

绑定挂载的文件所有权冲突核心是本地用户UID/GID与容器内user用户不匹配，修改devcontainer.json，将本地用户的UID/GID动态传入构建参数：

"build": {
    "dockerfile":"Dockerfile-r",
    "context":"..",
    "args": {
        "R_VERSION":"4.2.1",
        "USER_UID": "${localEnv:UID}",
        "USER_GID": "${localEnv:GID}"
    }
},

2. 修复挂载权限配置

在workspaceMount中添加UID/GID映射参数，确保挂载目录自动匹配容器内用户权限：

"workspaceMount": "source=${localWorkspaceFolder},target=/home/user/workspace,type=bind,consistency=cached,uid=${localEnv:UID},gid=${localEnv:GID}",

3. 修正Dockerfile的组权限错误

Dockerfile中chown $USERNAME:$USER_UID是笔误，组ID应该用USER_GID而非USER_UID，修改为：

RUN mkdir -p /home/user/workspace && \
    chown $USERNAME:$USER_GID /home/user/workspace

4. 统一R版本配置

Dockerfile基础镜像版本是4.2.1，但devcontainer.json传入的R_VERSION是4.1.2，版本不统一。要么将devcontainer.json的R_VERSION改为4.2.1，要么修改Dockerfile使用动态版本：

FROM rocker/r-ver:${R_VERSION}

内容的提问来源于stack exchange，提问作者thewayup