File permissions in containers

Inside a container, Linux permissions work as on any server: a process can only write where its user is allowed to. Users are numbers (UIDs), shared between the container and the server.

How it works

COPY creates files owned by root unless --chown is given. A named volume takes the owner of the folder it is mounted on the first time; a bind mount keeps the owner the files have on the server, a UID that may not exist in the container.

What breaks

chmod 777 makes the error go away and opens the folder to every process. Give the folder to the app's user instead (chown or COPY --chown), and check with docker exec api ls -ld on the folder.

In a terminal

docker exec api id
docker exec api ls -ld /app/uploads

See it break, then fix it

Write the Dockerfile or the compose file, type the docker commands, and watch a simulated server run them through reboots, upgrades and traffic. Free to start.

Open the learning path Open the sandbox