<p>As described in <a href="https://github.com/docker-library/tomcat/issues/35" rel="nofollow noreferrer">https://github.com/docker-library/tomcat/issues/35</a>, this is related to the storage driver used (aufs).  Changing to use overlay2 solved the issue:</p>

<p><a href="https://docs.docker.com/storage/storagedriver/overlayfs-driver/" rel="nofollow noreferrer">https://docs.docker.com/storage/storagedriver/overlayfs-driver/</a></p>

CC BY-SA 3.0
2018-02-28T09:22:39.377Z
2018-02-28T09:22:39.377Z
Jake Feasel
<p>I have been getting some unexpected failures with the execution of my Docker images when running on my Ubuntu 16.04.3 LTS machine. I'm using Docker version 18.02.0-ce (edge), installed from apt. I've narrowed down the problem enough to demonstrate it with this Dockerfile:</p>

<pre><code>FROM tomcat:8.5.24-jre8-alpine

RUN adduser -D test

RUN chown -R test "$CATALINA_HOME"

USER test

RUN ls "$CATALINA_HOME"/webapps
</code></pre>

<p>When I attempt to build this, here's the result:</p>

<pre><code>$ docker build -t test test/
Sending build context to Docker daemon  163.4MB
Step 1/5 : FROM tomcat:8.5.24-jre8-alpine
 ---&gt; 134d23a9a14e
Step 2/5 : RUN adduser -D test
 ---&gt; Using cache
 ---&gt; a6f70ba83b8d
Step 3/5 : RUN chown -R test "$CATALINA_HOME"
 ---&gt; Using cache
 ---&gt; 8a0fae3db0a8
Step 4/5 : USER test
 ---&gt; Using cache
 ---&gt; 45fdf333232b
Step 5/5 : RUN ls "$CATALINA_HOME"/webapps
 ---&gt; Running in 48711dfb9569
ls: /usr/local/tomcat/webapps/ROOT: Permission denied
ls: /usr/local/tomcat/webapps/examples: Permission denied
ls: /usr/local/tomcat/webapps/docs: Permission denied
ls: /usr/local/tomcat/webapps/host-manager: Permission denied
ls: /usr/local/tomcat/webapps/manager: Permission denied
The command '/bin/sh -c ls "$CATALINA_HOME"/webapps' returned a non-zero code: 1
</code></pre>

<p>These "Permission denied" errors are very strange to me, since the <code>chown</code> command should have given ownership of the whole /usr/local/tomcat folder, including the subfolders.</p>

<p>I have tried this same scenario with many different versions of Docker on my Ubuntu host, all with the same result. However, when I tried building this image on my Mac OS machine, it worked fine.</p>

<p>One slight variation that I have found which works around the problem is to give the "test" user access to the "root" group, like so:</p>

<pre><code>RUN adduser -D test -G root
</code></pre>

<p>With this simple change, the Dockerfile builds. So it seems obvious to me that somehow group membership permissions are involved, but I can't imagine why that would matter since the user is the owner. Also I can't imagine why building on Linux is different than building on Mac OS.</p>

<ul>
<li>edit -
This seems to be the same issue described here: <a href="https://github.com/docker-library/tomcat/issues/35" rel="nofollow noreferrer">https://github.com/docker-library/tomcat/issues/35</a></li>
</ul>

CC BY-SA 3.0
2018-02-23T19:56:13.450Z
I just ran your Dockerfile exactly, and had no errors. `~/test $ docker build -t tomcat-test .` It successfully listed everything in the 'webapps' dir. Try deleting the pulled image for `tomcat:8.5.24-jre8-alpine` (or even all your images) and rebuilding.
BoomShadow
CC BY-SA 3.0
2018-02-23T22:06:31.340Z
@BoomShadow I've cleared out everything, even so far as to use `docker system prune -a` to clear the local cache. Unfortunately, the problem somehow persists. I assume you built on Linux?
Jake Feasel
CC BY-SA 3.0
2018-02-23T22:12:39.580Z
May worth doing a ls -al $CATALINA_HOME to see ownership and permissions on its content instead of listing webapps content... But that sounds strange indeed (maybe an apparmor/selinux Config somewhere)
Tensibai
CC BY-SA 3.0
2018-02-23T22:44:03.200Z
Is selinux running? Does it work if disabled?
James Shewey
CC BY-SA 3.0
2018-02-23T23:09:40.277Z
@JamesShewey there is no selinux on my system.
Jake Feasel
CC BY-SA 3.0
2018-02-23T23:12:44.123Z
@Tensibai I have disabled apparmor, with no improvement.
Jake Feasel
CC BY-SA 3.0
2018-02-24T21:17:09.453Z
@JakeFeasel yep. I ran mine on Linux. I also just tried on Mac. Both work without issues. My Linux is Ubuntu 16.04 running docker stable 17.12.0-ce. I also just ran a 3rd test by installing Docker Edge 18.02.0-ce and ran it again. I still have no errors. Something must be wrong with your Docker and you need to re-install Docker itself.
BoomShadow
CC BY-SA 3.0
2018-02-27T14:01:33.410Z
See update: https://github.com/docker-library/tomcat/issues/35
Jake Feasel
CC BY-SA 3.0
2018-02-27T19:36:25.613Z
I built a Dockerfile like yours and got no errors, `Docker version 17.12.0-ce, build c97c6d6` :(.
Vincenzo Pii
CC BY-SA 3.0
2018-02-28T23:16:48.907Z
Vincenzo - what docker storage driver were you using?
Jake Feasel
<docker><linux><permissions><user-namespaces>
Permission errors with non-root USER when running on Linux
Jake Feasel
# Permission errors with non-root USER when running on Linux

(Asked by: username_0 on 2018-02-23)

I have been getting some unexpected failures with the execution of my Docker images when running on my Ubuntu 16.04.3 LTS machine. I'm using Docker version 18.02.0-ce (edge), installed from apt. I've narrowed down the problem enough to demonstrate it with this Dockerfile:
FROM tomcat:8.5.24-jre8-alpine

RUN adduser -D test

RUN chown -R test "$CATALINA_HOME"

USER test

RUN ls "$CATALINA_HOME"/webapps

When I attempt to build this, here's the result:
$ docker build -t test test/
Sending build context to Docker daemon  163.4MB
Step 1/5 : FROM tomcat:8.5.24-jre8-alpine
 ---> 134d23a9a14e
Step 2/5 : RUN adduser -D test
 ---> Using cache
 ---> a6f70ba83b8d
Step 3/5 : RUN chown -R test "$CATALINA_HOME"
 ---> Using cache
 ---> 8a0fae3db0a8
Step 4/5 : USER test
 ---> Using cache
 ---> 45fdf333232b
Step 5/5 : RUN ls "$CATALINA_HOME"/webapps
 ---> Running in 48711dfb9569
ls: /usr/local/tomcat/webapps/ROOT: Permission denied
ls: /usr/local/tomcat/webapps/examples: Permission denied
ls: /usr/local/tomcat/webapps/docs: Permission denied
ls: /usr/local/tomcat/webapps/host-manager: Permission denied
ls: /usr/local/tomcat/webapps/manager: Permission denied
The command '/bin/sh -c ls "$CATALINA_HOME"/webapps' returned a non-zero code: 1

These "Permission denied" errors are very strange to me, since the chown command should have given ownership of the whole /usr/local/tomcat folder, including the subfolders.
I have tried this same scenario with many different versions of Docker on my Ubuntu host, all with the same result. However, when I tried building this image on my Mac OS machine, it worked fine.
One slight variation that I have found which works around the problem is to give the "test" user access to the "root" group, like so:
RUN adduser -D test -G root

With this simple change, the Dockerfile builds. So it seems obvious to me that somehow group membership permissions are involved, but I can't imagine why that would matter since the user is the owner. Also I can't imagine why building on Linux is different than building on Mac OS.

edit -
This seems to be the same issue described here: https://github.com/docker-library/tomcat/issues/35

**Tags:** docker, linux, permissions, user-namespaces

> **Comments:**
> **username_1**: I just ran your Dockerfile exactly, and had no errors. `~/test $ docker build -t tomcat-test .` It successfully listed everything in the 'webapps' dir. Try deleting the pulled image for `tomcat:8.5.24-jre8-alpine` (or even all your images) and rebuilding.  
> **username_0**: @username_1 I've cleared out everything, even so far as to use `docker system prune -a` to clear the local cache. Unfortunately, the problem somehow persists. I assume you built on Linux?  
> **username_2**: May worth doing a ls -al $CATALINA_HOME to see ownership and permissions on its content instead of listing webapps content... But that sounds strange indeed (maybe an apparmor/selinux Config somewhere)  
> **username_3**: Is selinux running? Does it work if disabled?  
> **username_0**: @JamesShewey there is no selinux on my system.  
> **username_0**: @username_2 I have disabled apparmor, with no improvement.  
> **username_1**: @JakeFeasel yep. I ran mine on Linux. I also just tried on Mac. Both work without issues. My Linux is Ubuntu 16.04 running docker stable 17.12.0-ce. I also just ran a 3rd test by installing Docker Edge 18.02.0-ce and ran it again. I still have no errors. Something must be wrong with your Docker and you need to re-install Docker itself.  
> **username_0**: See update: https://github.com/docker-library/tomcat/issues/35  
> **username_4**: I built a Dockerfile like yours and got no errors, `Docker version 17.12.0-ce, build c97c6d6` :(.  
> **username_0**: Vincenzo - what docker storage driver were you using?  

---

## 1 answers

### Answer by username_0 on 2018-02-28. Score: 2 | Accepted answer

As described in <https://github.com/docker-library/tomcat/issues/35>, this is related to the storage driver used (aufs). Changing to use overlay2 solved the issue:

<https://docs.docker.com/storage/storagedriver/overlayfs-driver/>


---

