Docker on Mac and Linux issues with permissions

Question

I'm having a problem with the permissions of files created on shared volumes (this is unfortunately a common issue). When I run the following on linux (ubuntu) the file created ends up being owned by root. When I run this on OSX, the file ends up being owned by the user who run the docker command.

cd
mkdir temp-docker
docker run --rm -v ~/temp-docker/:/root/temp ubuntu /bin/touch /root/temp/touched
ls -la temp-docker/touched
# rm -Rf temp-docker

output from linux

-rw-r--r-- 1 root root 0 Nov 24 09:48 temp-docker/touched

output from osx

-rw-r--r--  1 MyUser  staff     0B 24 Nov 09:48 temp-docker/touched

Is there a way to easily mimic the behaviour of OSX? Or does this happen to work because OSX is using vagrant and vboxsf under the hood and there's no way to reproduce this easily on linux?

Answer 1

I don't know about 'easily', and it requires running the container as a user other than root (which you should probably do anyway).

But here's an example, running Docker 1.9

My Dockerfile looks something like this:

FROM ubuntu:14.04

# Setup user environment
RUN useradd -d /home/dtest -m dtest

# Create a shared data volume
RUN mkdir /var/shared/
RUN chown -R dtest:dtest /var/shared
VOLUME /var/shared

WORKDIR /home/dtest

# Link in shared parts to the home directory
RUN ln -s /var/shared /home/dtest/shared

RUN chown -R dtest: /home/dtest
USER dtest

CMD /bin/bash

After building my image, let's call it dtest/test, I run it like this:

$ docker run --rm -v $(pwd):/var/shared/ -it dtest/test bash

# on the container:
dtest@33b5a1ee6c62:~$ ls -l
total 0
lrwxrwxrwx 1 dtest dtest 11 Nov 24 20:47 shared -> /var/shared
dtest@33b5a1ee6c62:~$ ls -l shared/
total 4
-rw-r--r-- 1 dtest staff 642 Nov 24 20:47 Dockerfile
dtest@33b5a1ee6c62:~$ echo "Test" > /var/shared/foo
dtest@33b5a1ee6c62:~$ ls -l $(pwd)/shared/
total 8
-rw-r--r-- 1 dtest staff 642 Nov 24 20:47 Dockerfile
-rw-r--r-- 1 dtest staff   5 Nov 24 20:52 foo

# on the OSX host
$ ls -l
total 16
-rw-r--r--  1 dtest  staff  642 Nov 24 15:47 Dockerfile
-rw-r--r--  1 dtest  staff    5 Nov 24 15:52 foo

This worked in Docker 1.8.x too, though I had to add an empty file in /var/shared before adding it as a VOLUME:

# Create a shared data volume
# We need to create an empty file, otherwise the volume will
# belong to root.
# This is probably a Docker bug.
RUN mkdir /var/shared/
RUN touch /var/shared/placeholder
RUN chown -R dtest:dtest /var/shared
VOLUME /var/shared

Credit for this method goes over to this blogpost on the Tip of creating a devbox.