Docker容器间共享文件权限被拒问题求助（附配置）

1. Use Docker Named Volumes (Cleanest Fix)

Host-mounted directories are prone to permission conflicts because they inherit host UID/GID settings. Switching to a Docker-managed named volume will let Docker handle permission synchronization automatically.

Update your Flask app’s docker-compose.yml:

version: '3.7'
services:
  app:
    container_name: app
    image: mlengine
    networks:
      - network1
    build:
      context: .
      dockerfile: DockerfileEngine
    volumes:
      - logData:/root/project/logs_n_status  # Use named volume instead of host dir
    ports:
      - 7011:3000
    expose:
      - "3000"
volumes:
  logData:  # Define the named volume

Update your Shiny dashboard’s docker-compose.yml:

version: '3.7'
services:
  dashboard:
    container_name: dashboard
    image: mlapidashboard
    networks:
      - network1
    build:
      context: .
      dockerfile: DockerfileRTD
    volumes:
      - logData:/root/project/logs_n_status:ro  # Mount the same volume read-only
    ports:
      - 9000:3838
networks:
  network1:
volumes:
  logData:
    external: false  # Let Docker create and manage the volume

Then redeploy both containers:

docker-compose down -v
docker-compose up --build

2. Align UIDs Across Containers and Host

If you need to stick with host-mounted directories, ensure both containers run with a user that matches the UID/GID of your host’s logs_n_status directory.

First, get the host directory’s UID/GID:

ls -ln /home/mlprod/dmda/testAPI/logs_n_status

Look for the numbers in the third and fourth columns (e.g., 1000 for UID, 1000 for GID).

Update Flask’s DockerfileEngine:
Run the Flask app with a user that has the same UID as your host:

# Add these lines after setting WORKDIR /root/project
RUN useradd -u 1000 -m appuser  # Replace 1000 with your host UID
RUN chown -R appuser:appuser /root/project
USER appuser  # Switch to this user before running the app

Update Shiny’s DockerfileDashboard:
Adjust the shiny user’s UID to match the host:

# Add these lines after installing R packages
RUN usermod -u 1000 shiny  # Replace 1000 with your host UID
RUN groupmod -g 1000 shiny  # Replace 1000 with your host GID
RUN chown -R shiny:shiny /root/project/logs_n_status

Redeploy both containers, and the log files created by Flask will now be readable by Shiny.

3. Use ACLs on the Host Directory

If you can’t modify container users, set Access Control Lists (ACLs) on the host directory to explicitly grant the Shiny user’s UID access:

# Replace 1000 with the UID of the `shiny` user in your container
sudo setfacl -R -m u:1000:rwx /home/mlprod/dmda/testAPI/logs_n_status
sudo setfacl -R -m d:u:1000:rwx /home/mlprod/dmda/testAPI/logs_n_status

The second command ensures new files created in the directory inherit the ACL permissions.

4. Test with Shiny Running as Root (Not Recommended for Production)

As a quick test to confirm the issue is user permissions, configure Shiny to run as root:

Update DockerfileDashboard:

# Add this line to copy a modified config (create the file first)
COPY shiny-server.conf /etc/shiny-server/shiny-server.conf

Create a shiny-server.conf file in your Shiny build context:

run_as root;
site_dir /srv/shiny-server;
log_dir /var/log/shiny-server;
directory_index on;

Redeploy the Shiny container—this should let it read root-owned logs, but avoid this in production due to security risks.

Why Your Current Setup Isn’t Working #

You tried setting chmod -R 777 /root/project/logs_n_status in the Shiny Dockerfile, but this has no effect because host-mounted directories override container directory permissions. The permissions of the host directory and its files take precedence, so changing container directory permissions won’t fix the issue.

内容的提问来源于stack exchange，提问作者Mousam Singh