docker-library / docker-library/postgres
rootless container permission error
Nobody has claimed this yet.
- Dominant language
- Shell
- Stars
- 2.5k
- Forks
- 1.2k
- PR merge metrics
- No merged PRs in 30d
Description
Creating a container with "user:1000:1000" in the compose file generates these errors:
chmod: /var/lib/postgresql/data: Operation not permitted
chmod: /var/run/postgresql: Operation not permitted
The files belonging to this database system will be owned by user "myrootlessuser".
This user must also own the server process.
...
fixing permissions on existing directory /var/lib/postgresql/data ... initdb: error: could not change permission of directory "/var/lib/postgresql/data": Operation not permitted
This seems to happen because i'm using a subuid (which the volume correctly chowns to the bind path)
A solution to this could be to let us set the postgres user UID and GID manually, as suggested in https://github.com/docker-library/postgres/issues/1068
This works without using subuids, but doesn't if so:
services:
pgdbex:
image: postgres:16-alpine
cap_drop:
- ALL
user: 1000:1000
environment:
POSTGRES_USER:
POSTGRES_PASSWORD:
POSTGRES_DB:
volumes:
- ./db:/var/lib/postgresql/data
This doesn't work in either case:
services:
pgdbex:
image: postgres:16-alpine
cap_drop:
- ALL
user: 1000:1000
environment:
POSTGRES_USER:
POSTGRES_PASSWORD:
POSTGRES_DB:
volumes:
- pgdbdata:/var/lib/postgresql/data
volumes:
pgdbdata:
driver: local
driver_opts:
o: bind
type: none
device: ./db
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the failure with the two Compose examples in the issue, comparing bind mounts and the named volume under a rootless user. Then inspect the Postgres image's initialization and permission handling. Done means a rootless container using user 1000:1000 can initialize the database and start successfully without permission errors.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, docker-compose, postgres
- Domain
- databases, devops, infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100