解决Docker Compose部署GitLab-ce时的权限拒绝问题

Hey there, let's work through this permission denied problem you're hitting with your Dockerized GitLab CE setup. Permission issues in this context almost always tie back to volume ownership, missing directories, or security tool restrictions—let's break down the most common fixes step by step:

1. Fix Host Volume Directory Permissions #

GitLab's official Docker image runs as a dedicated user with UID/GID 999. If your host directories don't have matching ownership, the container will get blocked from writing to them. Run these commands to set the correct permissions:

sudo chown -R 999:999 /srv/gitlab/config /srv/gitlab/logs
# Don't forget the data directory if you're using it (your config cut off here!)
sudo chown -R 999:999 /srv/gitlab/data

2. Complete Your Docker Compose Volume Configuration #

Looking at your config, the volumes section cuts off at /...—GitLab requires three core volume mounts to function properly. Make sure your volumes block is complete:

volumes:
  - '/srv/gitlab/config:/etc/gitlab'
  - '/srv/gitlab/logs:/var/log/gitlab'
  - '/srv/gitlab/data:/var/opt/gitlab'

Missing the /var/opt/gitlab mount (which stores repository data and internal state) is a common cause of silent permission failures during startup.

3. Check for SELinux/AppArmor Restrictions #

If you're on a Linux distribution with SELinux enabled (like RHEL/CentOS/Rocky) or AppArmor (like Ubuntu), these security tools might block Docker from accessing your host directories:

• Test with SELinux temporarily disabled:

  sudo setenforce 0
  

  If this fixes the issue, apply a permanent SELinux rule instead of leaving it disabled:

  sudo semanage fcontext -a -t container_file_t "/srv/gitlab(/.*)?"
  sudo restorecon -Rv /srv/gitlab
  

• For AppArmor, you may need to adjust the profile for Docker or mark the /srv/gitlab directory as trusted.

4. Inspect Container Logs for Exact Errors #

To get to the root of the problem, check the GitLab container logs for specific permission denied messages:

docker logs gitlab-master

Search for keywords like permission denied or failed to write—this will tell you exactly which file/directory is causing the issue, so you can target your fix.

5. Verify Container Runtime User (Last Resort) #

In rare cases, you might need to explicitly specify the user for the GitLab container. Add this line to your web service in docker-compose.yml:

user: "999:999"

Only use this if the directory ownership fix doesn't work—most of the time, adjusting host permissions is sufficient.

Start with steps 1 and 2 first, as those are the most frequent culprits for this kind of issue. If you still hit problems, share the specific error lines from the container logs and we can dig deeper!

内容的提问来源于stack exchange，提问作者Rukeith