docker-library / docker-library/postgres

rootless container permission error

Open
#1,287 8 comments 2 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Shell
Stars
2.5k
Forks
1.2k
PR merge metrics
No merged PRs in 30d

Description

Creating a container with "user:1000:1000" in the compose file generates these errors:

chmod: /var/lib/postgresql/data: Operation not permitted
chmod: /var/run/postgresql: Operation not permitted
The files belonging to this database system will be owned by user "myrootlessuser".
This user must also own the server process.

...

fixing permissions on existing directory /var/lib/postgresql/data ... initdb: error: could not change permission of directory "/var/lib/postgresql/data": Operation not permitted

This seems to happen because i'm using a subuid (which the volume correctly chowns to the bind path)

A solution to this could be to let us set the postgres user UID and GID manually, as suggested in https://github.com/docker-library/postgres/issues/1068

This works without using subuids, but doesn't if so:

services:
  pgdbex:
    image: postgres:16-alpine
    cap_drop:
      - ALL
    user: 1000:1000
    environment:
      POSTGRES_USER: 
      POSTGRES_PASSWORD: 
      POSTGRES_DB: 
    volumes:
      - ./db:/var/lib/postgresql/data 

This doesn't work in either case:

services:
  pgdbex:
    image: postgres:16-alpine
    cap_drop:
      - ALL
    user: 1000:1000
    environment:
      POSTGRES_USER: 
      POSTGRES_PASSWORD: 
      POSTGRES_DB: 
    volumes:
      - pgdbdata:/var/lib/postgresql/data 

volumes:
  pgdbdata:
    driver: local
    driver_opts:
      o: bind
      type: none
      device: ./db

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the failure with the two Compose examples in the issue, comparing bind mounts and the named volume under a rootless user. Then inspect the Postgres image's initialization and permission handling. Done means a rootless container using user 1000:1000 can initialize the database and start successfully without permission errors.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, docker-compose, postgres
Domain
databases, devops, infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.