macOS下Podman执行Spring Boot2.7 build-image构建镜像失败

问题现象 #

执行 mvn spring-boot:build-image 命令通过 Podman 构建 Spring Boot 容器镜像时，首次触发权限拒绝报错，核心报错为无权访问 Docker daemon socket，完整日志如下：

[INFO] --- spring-boot-maven-plugin:2.7.0:build-image (default-cli) @ sample-spring-service ---
[INFO] Building image 'docker.io/library/sample-spring-service:1.0.0-SNAPSHOT'
[INFO] 
[INFO]  > Pulling builder image 'docker.io/paketobuildpacks/builder:base' 100%
[INFO]  > Pulled builder image 'docker.io/paketobuildpacks/builder@sha256:94e65320ba1682bc68cbbf1d4f63693bb62cc06c7077bfa3e3bccac7fdc10628'
[INFO]  > Pulling run image 'docker.io/paketobuildpacks/run:base-cnb' 100%
[INFO]  > Pulled run image 'docker.io/paketobuildpacks/run@sha256:3e889016680c0e2ef1e8b1bfdad2d6d34966c860a53ccfcfb3e269d48ed65fed'
[INFO]  > Executing lifecycle version v0.14.1
[INFO]  > Using build cache volume 'pack-cache-744ddec35876.build'
[INFO] 
[INFO]  > Running creator
[INFO]     [creator]     ERROR: initializing analyzer: getting previous image: Got permission denied while trying to connect to the Docker daemon socket at unix:///var/run/docker.sock: Get "http://%2Fvar%2Frun%2Fdocker.sock/v1.24/info": dial unix /var/run/docker.sock: connect: permission denied

环境信息 #

当前环境 Podman 版本为 4.1.0，核心版本信息如下：

host:
  arch: amd64
  buildahVersion: 1.26.1
  cgroupControllers:
...
version:
  APIVersion: 4.1.0
  Built: 1651853754
  BuiltTime: Fri May  6 18:15:54 2022
  GitCommit: ""
  GoVersion: go1.18
  Os: linux
  OsArch: linux/amd64
  Version: 4.1.0

已尝试操作 #

• 修改 socket 权限、以 root 身份运行 Podman，问题未解决
• 相同构建流程使用 Docker 可正常执行，基础命令 podman create alpine ls 运行无异常
• 调整 pom.xml 中 spring-boot-maven-plugin 插件配置，初始配置如下：

<plugin>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-maven-plugin</artifactId>
    <configuration>
        <docker>
        <!--  <host>unix:///Users/mike/.local/share/containers/podman/machine/podman-machine-default/podman.sock</host>
            <host>unix:///run/user/1000/podman/podman.sock</host>
        -->
            <bindHostToBuilder>true</bindHostToBuilder>
        </docker>
    </configuration>
</plugin>

• 启用配置中 unix:///run/user/1000/podman/podman.sock 的 host 参数后，触发新的文件不存在报错，日志如下：

[INFO] --- spring-boot-maven-plugin:2.7.0:build-image (default-cli) @ sample-spring-service ---
[INFO] Building image 'docker.io/library/sample-spring-service:1.0.0-SNAPSHOT'
[INFO] 
[INFO] I/O exception (java.io.IOException) caught when processing request to {}->docker://localhost:2376: com.sun.jna.LastErrorException: [2] No such file or directory
[INFO] Retrying request to {}->docker://localhost:2376
[INFO] I/O exception (java.io.IOException) caught when processing request to {}->docker://localhost:2376: com.sun.jna.LastErrorException: [2] No such file or directory
[INFO] Retrying request to {}->docker://localhost:2376
[INFO] I/O exception (java.io.IOException) caught when processing request to {}->docker://localhost:2376: com.sun.jna.LastErrorException: [2] No such file or directory
[INFO] Retrying request to {}->docker://localhost:2376
[INFO]  > Pulling builder image 'docker.io/paketobuildpacks/builder:base' 100%

1. 启用 Podman 系统级 Docker 兼容 socket
   执行以下命令开启服务并设置开机自启：

   systemctl enable --now podman.socket
   

   确认 /var/run/docker.sock 已软链到 Podman socket 路径，若未自动生成软链，手动执行创建：

   ln -sf /run/podman/podman.sock /var/run/docker.sock
   

2. 修正 Maven 插件配置
   移除配置中用户级 socket 的路径配置，显式指定系统级 docker.sock 路径，正确配置如下：

   <plugin>
       <groupId>org.springframework.boot</groupId>
       <artifactId>spring-boot-maven-plugin</artifactId>
       <configuration>
           <docker>
               <host>unix:///var/run/docker.sock</host>
               <bindHostToBuilder>true</bindHostToBuilder>
           </docker>
       </configuration>
   </plugin>
   

   报错根因：build-image 流程启动的构建容器默认以 root 权限运行，无法访问普通用户专属的 /run/user/1000/ 路径下的用户态 Podman socket，硬编码该路径会触发文件找不到、权限拒绝类问题。

3. 配置 socket 访问权限
   将当前执行 Maven 命令的用户加入 docker 用户组，避免非 root 用户访问 socket 被拒绝：

   usermod -aG docker $USER
   newgrp docker
   

4. 验证后重新构建
   先执行 podman info 确认命令无权限报错，再重新执行 mvn spring-boot:build-image 即可正常完成镜像构建。

内容的提问来源于stack exchange，提问作者MHU