Error: error resolving dockerfile path: copying dockerfile: creating file: open /kaniko/Dockerfile: permission denied

[yashcodecollab]

Hi I am still running into the same issue. Is there a resolution for this @tejal29

Error: error resolving dockerfile path: copying dockerfile: creating file: open /kaniko/Dockerfile: permission denied

[tejal29]

@yashcodecollab please specify --context=pathMounted/ and -f dockerfile as path relative to pathMounted

Does that make sense?
Please see examples in README

[TBBle]

Edit: Moved my bug to #1381.

I suspect the problem for @yashcodecollab is that the /kaniko directory in the container is not writeable, perhaps kaniko has been mounted with read-only root set?

[adhikasp]

I got this exact same error

Error: error resolving dockerfile path: copying dockerfile: creating file: open /kaniko/Dockerfile: permission denied

The problem in my case was I am trying to run the kaniko container under non-root user. After changing back to root, it run fine.

[ttfreeman]

@adhikasp Kaniko is supposed to work with non-root user.

[TBBle]

Internally, Kaniko copies the given Dockerfile to /kaniko/Dockerfile, so it can only work with a non-root user, if the non-root user has permission to write to /kaniko.

So either the container in question was faulty and /kaniko is supposed to be world-writeable, or the kaniko container needs to be run as either root, or a specific UID that owns /kaniko.

[lvarin]

I am suffering from this problem as well. The only user/UID than can write in /kaniko and run kaniko is root/0:

/kaniko $ ls -alh
total 110M   
drwxr-xr-x    1 0        0           4.0K Apr 26  2021 .
drwxr-xr-x    1 0        0           4.0K Jan 25 11:42 ..

And this folder is a constant (If I read the code correctly:):

https://github.com/GoogleContainerTools/kaniko/blob/main/pkg/constants/constants.go#L31

[luidoc]

Hi I am still running into the same issue. Is there a resolution for this, running the kaniko container under non-root user.
../executor --dockerfile=Dockerfile --context=/kaniko/buildcontext --no-push
Error: error resolving dockerfile path: copying dockerfile: creating file: open /kaniko/Dockerfile: permission denied

opts.DockerfilePath = constants.DockerfilePath
DockerfilePath = "/kaniko/Dockerfile"

[imjasonh]

Basically, kaniko expects to run as root inside the container. There are a bunch of things that don't work as expected if that's not satisfied, including apparently this.

[very-doge-wow]

So what exactly is supposed to be the solution to this problem? As far as my understanding goes, kaniko was supposed to work without root privileges. I believe making the constant mentioned by @lvarin configurable would solve the issue, as users then could configure their own paths which ARE writable by non-root users.

[imjasonh]

So what exactly is supposed to be the solution to this problem?

The solution to the problem is for someone to investigate this issue and fix it. It could even be you! 😄

This has also been requested in #1945, and as far as I know it should be possible. My main concern would be testing this path well end-to-end, since I wouldn't be surprised if there are lots of corners of the code that subtly assume /kaniko is the reserved directory.

[TBBle]

I don't think #1945 solves this issue, because even if you can move the KanikoDir, it'll still be owned by root in the published container image, per https://github.com/GoogleContainerTools/kaniko/blob/main/deploy/Dockerfile.

Although the README says that Kaniko (the binary) can run as a non-root user if you don't need it to do 'root-only' things, the same document strongly recommends to use Kaniko via the published container image, which does require running kaniko as root just to process the Dockerfile.

A solution for this ticket might be to simply change the Dockerfiles so that /kaniko is writable by all users.

[imjasonh]

A solution for this ticket might be to simply change the Dockerfiles so that /kaniko is writable by all users.

That seems like an easy and worthwhile change. If someone sends me a PR I'll approve it 👍

[vvatlin]

Still have the same issue