Running container as different user fails with permission denied error

[irfadrazick]

• Version: coderaiser/cloudcmd:10.4.1
• Node Version: v10.6.0
• OS: Linux infosak 4.4.0-127-generic #153-Ubuntu SMP Sat May 19 10:58:46 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
• Browser name/version: Chrome/67
• Used Command Line Parameters: docker run --name cloudcmd -u 10000 -p 8000:8000 -v /var/www:/var/www -v /var/log:/var/log coderaiser/cloudcmd:10.4.1
• Changed Config: Using different user to run container

When I use different user other than default root to launch a container I am unable to get it started as it tries to switch to /root directory and gets permission denied.

docker: Error response from daemon: OCI runtime create failed: container_linux.go:348: starting container process caused "chdir to cwd (\"/root\") set in config.json failed: permission denied": unknown.

I have a use case where I allow access to file which has sensitive information only to web user www-data where other users cannot view that file, hence it makes sense to run the container as different user.

In the Dockerfile I see WORKDIR is changed to /root. Removing the line should fix this problem.

cloudcmd/Dockerfile

Line 16 in 4c453e2

WORKDIR /root

Please kindly check and do the needful.

Thank you

[coderaiser]

That is very strange. I can not reproduce this. When I run

docker run --name cloudcmd -u 10000 -p 8000:8000 -v /var/www:/var/www -v /var/log:/var/log coderaiser/cloudcmd:10.4.1

Everything works good with docker v17.
What version of docker do you use?

[coderaiser]

Closed due to a long time of inactivity.

[irfadrazick]

Sorry for the delay, my docker version is 18.06.0-ce, build 0ffa825

[aaron-sua]

I am seeing this issue as well.
I typically start a container with a service user, let's say 'appuser'
if I then try to docker exec -it -u root
I get the above error
If I change the working_dir to something root has direct access, like /tmp
it works fine

[luisbrandao]

Me too, in many conteiners. ismaleiva90/weblogic12 and the oficial jenkins one are exemples.
I cant get root in those conteiners