Dockerfile中CHMOD命令未生效，镜像权限未按预期修改

Hey there! Let's break down why those permission changes aren't sticking. The core issue here boils down to how Docker handles VOLUME declarations in parent images.

The official jenkins/jenkins:2.119 image marks /var/jenkins_home as a VOLUME. Once a VOLUME is defined in a parent image, any modifications you make to that directory in your Dockerfile—like copying files or running chmod—won't be saved to the final image. Docker treats VOLUME directories specially during builds: changes are written to a temporary volume that gets discarded as soon as the build finishes. When you run your container, it spins up a fresh anonymous volume for /var/jenkins_home, so you're seeing default permissions instead of your modified ones.

Fix 1: Set Permissions at Container Startup (Simple & Reliable) #

Since we can't modify the VOLUME directory during the build, we can adjust permissions when the container starts. Here's how to update your setup:

1. Create a small entrypoint script named setup-ssh.sh in your build folder:

#!/bin/bash
# Fix permissions for the SSH directory and files
chmod 700 /var/jenkins_home/.ssh
chmod 600 /var/jenkins_home/.ssh/*

# Launch the original Jenkins entrypoint
exec /usr/local/bin/jenkins.sh

2. Update your Dockerfile to include this script:

FROM jenkins/jenkins:2.119
USER jenkins
ENV HOME /var/jenkins_home

# Copy your SSH files as before
COPY --chown=jenkins:jenkins ssh ${HOME}/.ssh/
# Copy the setup script and make it executable
COPY setup-ssh.sh ${HOME}/setup-ssh.sh
RUN chmod +x ${HOME}/setup-ssh.sh

# Override the entrypoint to run our setup first
ENTRYPOINT ["/var/jenkins_home/setup-ssh.sh"]

Now every time the container starts, it will fix the SSH permissions before launching Jenkins—ensuring the changes apply to the mounted volume.

Fix 2: Copy Files to a Temporary Directory First (One-Time Setup) #

If you don't want to run permission checks on every startup, you can copy the SSH files to a non-VOLUME directory in the image, then move them to /var/jenkins_home when the container first runs:

FROM jenkins/jenkins:2.119
USER jenkins
ENV HOME /var/jenkins_home

# Copy SSH files to a temporary location (not a VOLUME)
COPY --chown=jenkins:jenkins ssh /tmp/jenkins_ssh/
# Set permissions here—these will stick since it's not a VOLUME
RUN chmod 700 /tmp/jenkins_ssh && chmod 600 /tmp/jenkins_ssh/*

# Create a script to move files only if .ssh doesn't exist
RUN echo '#!/bin/bash\n\
if [ ! -d ${HOME}/.ssh ]; then\n\
    mv /tmp/jenkins_ssh ${HOME}/.ssh\n\
fi\n\
exec /usr/local/bin/jenkins.sh' > ${HOME}/setup-ssh.sh && \
    chmod +x ${HOME}/setup-ssh.sh

ENTRYPOINT ["/var/jenkins_home/setup-ssh.sh"]

This way, the files are only copied once (the first time the container runs), avoiding repeated permission adjustments.

内容的提问来源于stack exchange，提问作者PeterLappo