配置Dockerfile：非root用户运行Elasticsearch并解决Maven权限问题

我是Linux新手，正在做技术栈容器化改造，碰到了两难的权限问题：

• 必须用非root用户运行才能满足Elasticsearch的运行要求；
• 但在CMD前加USER $USERNAME，会报权限错误：

  mkdir: cannot create directory ‘/root’: Permission denied Can not write to /root/.m2/copy_reference_file.log. Wrong volume permissions? Carrying on

• 要是删掉USER $USERNAME，Elasticsearch又跑不起来。

原Dockerfile代码 #

# Custom image from Maven on DockerHub
# Language: dockerfile
FROM maven:3.6.3-amazoncorretto-8

# Set the working dir
WORKDIR /app

# Create a non root user
ARG USERNAME=jefferson
ARG USER_UID=1000
ARG USER_GID=$USER_UID

# Add linux dependenciesq
RUN yum install wget -y
RUN yum install shadow-utils -y

# Create the user
RUN groupadd --gid $USER_GID $USERNAME \
    && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME \
    && yum install sudo -y \
    && echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME \
    && chmod 777 /etc/sudoers.d/$USERNAME \
    && sudo groupadd docker \
    && sudo usermod -aG docker $USERNAME \
    && newgrp docker 

# Change to the root folder and edit the settings.xml for Maven
WORKDIR /root/.m2
RUN rm -rf settings.xml
RUN echo '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" \
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" \
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 \
http://maven.apache.org/xsd/settings-1.0.0.xsd"> \
</settings>' >> settings.xml

WORKDIR /app

COPY . ./

USER $USERNAME

# Run the application
CMD ["mvn", "clean", "verify", "-Pcargo.run", "-X"]

修改后的Dockerfile #

# Custom image from Maven on DockerHub
FROM maven:3.6.3-amazoncorretto-8

# Set the working dir
WORKDIR /app

# Create a non root user
ARG USERNAME=jefferson
ARG USER_UID=1000
ARG USER_GID=$USER_UID

# Add linux dependencies
RUN yum install wget shadow-utils sudo -y

# Create the user and configure permissions
RUN groupadd --gid $USER_GID $USERNAME \
    && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME \
    && echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME \
    && chmod 0440 /etc/sudoers.d/$USERNAME \
    && groupadd docker \
    && usermod -aG docker $USERNAME

# 配置Maven使用非root用户的settings目录
RUN mkdir -p /home/$USERNAME/.m2 \
    && echo '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0" \
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" \
xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 \
http://maven.apache.org/xsd/settings-1.0.0.xsd"> \
</settings>' > /home/$USERNAME/.m2/settings.xml \
    && chown -R $USERNAME:$USERNAME /home/$USERNAME/.m2 \
    && chown -R $USERNAME:$USERNAME /app

# 切换到非root用户
USER $USERNAME

# 复制代码到工作目录
COPY . ./

# Run the application
CMD ["mvn", "clean", "verify", "-Pcargo.run", "-X"]

关键修改说明 #

• 迁移Maven配置到非root目录：原Dockerfile修改的是root用户的/root/.m2/settings.xml，切换非root用户后Maven会尝试访问自己家目录的.m2，找不到就会碰root目录触发权限错误。现在直接在非root用户的/home/$USERNAME/.m2下创建配置文件，并赋予对应权限。
• 修正目录与文件权限：
  • 给/app目录设置非root用户所有权，确保用户能读写代码和构建产物；
  • 把sudoers文件权限改成安全的0440（原777权限过于宽松，不符合sudo规范）；
  • 创建docker组时无需sudo，当前处于root身份可直接操作。
• 优化镜像构建步骤：合并冗余的yum安装命令，减少镜像层数。

内容的提问来源于stack exchange，提问作者Cody Wirth